HFkiller_full[.]zip

resource
unpack001/HFkiller_full/ps/Modules/ConfigDefenderPerformance/MSFT_MpPerformanceRecording.psm1

resource
unpack001/HFkiller_full/HFkiller_full.exe
unpack001/HFkiller_full/ps/Modules/AppBackgroundTask/Microsoft.Windows.AppBackgroundTask.Commands.dll
unpack001/HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppVClientPowerShell.resources.dll
unpack001/HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppvClientComConsumer.resources.dll
unpack001/HFkiller_full/ps/Modules/BitLocker/Microsoft.BitLocker.Structures.dll
unpack001/HFkiller_full/ps/Modules/BitsTransfer/Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll
unpack001/HFkiller_full/ps/Modules/DeliveryOptimization/Microsoft.Windows.DeliveryOptimization.AdminCommands.dll
unpack001/HFkiller_full/ps/Modules/Dism/Microsoft.Dism.PowerShell.dll
unpack001/HFkiller_full/ps/Modules/Dism/zh-HANS/Microsoft.Dism.Powershell.Resources.dll
unpack001/HFkiller_full/ps/Modules/DnsClient/dnslookup.dll
unpack001/HFkiller_full/ps/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.PowerShell.LocalAccounts.dll
unpack001/HFkiller_full/ps/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/zh-HANS/Microsoft.PowerShell.LocalAccounts.Resources.dll
unpack001/HFkiller_full/ps/Modules/MsDtc/zh-HANS/Microsoft.Dtc.PowerShell.Resources.dll
unpack001/HFkiller_full/ps/Modules/NetSecurity/Microsoft.Windows.Firewall.Commands.dll
unpack001/HFkiller_full/ps/Modules/NetSecurity/zh-HANS/Microsoft.Windows.Firewall.Commands.Resources.dll
unpack001/HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/Microsoft.PowerShell.DSC.FileDownloadManager.dll
unpack001/HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/zh-HANS/Microsoft.PowerShell.DSC.FileDownloadManager.Resources.dll
unpack001/HFkiller_full/ps/Modules/PersistentMemory/Microsoft.Storage.PersistentMemory.Management.Commands.dll
unpack001/HFkiller_full/ps/Modules/PersistentMemory/scmbridge.dll
unpack001/HFkiller_full/ps/Modules/PersistentMemory/zh-HANS/Microsoft.Storage.PersistentMemory.Management.Commands.Resources.dll
unpack001/HFkiller_full/ps/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.dll
unpack001/HFkiller_full/ps/Modules/Provisioning/provcmdlets.dll
unpack001/HFkiller_full/ps/Modules/Provisioning/provcommon.dll
unpack001/HFkiller_full/ps/Modules/Provisioning/provpackageapi.dll
unpack001/HFkiller_full/ps/Modules/Provisioning/wiminterop.dll
unpack001/HFkiller_full/ps/Modules/UEV/Microsoft.Uev.Commands.dll
unpack001/HFkiller_full/ps/Modules/Whea/Microsoft.Windows.Whea.WheaMemoryPolicy.dll
unpack001/HFkiller_full/ps/Modules/WindowsErrorReporting/Microsoft.WindowsErrorReporting.PowerShell.dll
unpack001/HFkiller_full/ps/Modules/WindowsSearch/Microsoft.WindowsSearch.Commands.dll
unpack001/HFkiller_full/ps/Modules/WindowsSearch/zh-HANS/Microsoft.WindowsSearch.Commands.Resources.dll
unpack001/HFkiller_full/ps/PSEvents.dll
unpack001/HFkiller_full/ps/en-US/powershell.exe.mui
unpack001/HFkiller_full/ps/powershell1.exe
unpack001/HFkiller_full/ps/powershell_ise.exe
unpack001/HFkiller_full/ps/pspluginwkr.dll
unpack001/HFkiller_full/ps/pwrshmsg.dll
unpack001/HFkiller_full/ps/pwrshsip.dll
unpack001/HFkiller_full/ps/zh-CN/PSEvents.dll.mui
unpack001/HFkiller_full/ps/zh-CN/powershell.exe.mui
unpack001/HFkiller_full/ps/zh-CN/pspluginwkr.dll.mui
unpack001/HFkiller_full/ps/zh-CN/pwrshmsg.dll.mui
unpack001/HFkiller_full/ps/zh-HANS/powershell_ise.resources.dll

HFkiller_full.zip

SHA256 1823903fe6dd190d4c3e7e563a026ee0042ff35337a3eba7c4bcc4beddcf942d
MD5 f638b2b8b7dec41171e45edf4a702fef
SHA1 3525fb4e287b2e3c24c4fdff6b2ebd3b1d67573f
SHA512 4da9aaec4b44ebd6c670a6b178c4793fc496bfb73782e4e94ee176b7b07cde73510dcd33a9168fa230ac54bedf6c4d9531657d9c29694ef6d343d199e2e39d7b
SSDEEP 196608:qtnQLEnFE6c9ibTITBR5L7ssG/3a3jv9dEeENeaUdwYe3kFK:6hFENibwPJ7zG/3a35+V7
TLSH
T146962371DB142C43EB0FA5B7D31CC81DE899D182845C5A1F38BC59DC587A680AB39FAB
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/HFkiller_full.exe

IMPHASH 87050e44bed9c94526afbc649429a627
SHA256 3ba31e83a49e1f514f970e12d9776a4035eb05b0b187a797068baaaec8b14775
MD5 5f5ad376c198f0d8401c4c651e35176e
SHA1 7cc3c367218dee1e526ec48ce1ee97b8de724ae3
SHA512 81c4c406a8d850809b05b1c9295d789acdc8bfdef324c80bb3e18fdb01b30c7ac48ac4ceb32178322dd3908cf18b767510138d1855740a53f720e7b4f67fbe10
SSDEEP 196608:CMDqObBmfud2q2XBEUs81uVdcc+rk84C7djGzVTNM88kydKV3:COqObndt410ycQk84C7IxTNekyde
TLSH
T17FD6AD56F3F801A9E5BBC178C5674517EBB2B8451320E7DF45A08A692F23BE06E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6207488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

RaiseException FreeLibrary SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter LocateXStateFeature AddVectoredExceptionHandler MultiByteToWideChar GetTickCount FlushInstructionCache QueryPerformanceFrequency QueryPerformanceCounter RtlLookupFunctionEntry RtlDeleteFunctionTable InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead GetTickCount64 DuplicateHandle VerSetConditionMask VerifyVersionInfoW QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority GetCurrentThreadId TlsAlloc GetCurrentThread CreateThread WaitForMultipleObjectsEx SignalObjectAndWait RtlCaptureContext SetThreadStackGuarantee VirtualQuery WriteFile GetStdHandle GetConsoleOutputCP MapViewOfFileEx UnmapViewOfFile GetCurrentProcessId InterlockedPopEntrySList GetModuleHandleW ExitProcess Sleep CreateMemoryResourceNotification VirtualAlloc VirtualFree VirtualProtect SleepEx SwitchToThread SuspendThread ResumeThread InitializeContext SetXStateFeaturesMask RtlRestoreContext CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer ReadFile GetFileSize GetEnvironmentVariableW SetEnvironmentVariableW CreateEventW SetEvent ResetEvent GetThreadContext SetThreadContext GetEnabledXStateFeatures CopyContext WerRegisterRuntimeExceptionModule RtlInstallFunctionTableCallback GetSystemDefaultLCID GetUserDefaultLCID RtlUnwind GetCurrentProcessorNumberEx FreeEnvironmentStringsW GetActiveProcessorGroupCount GetSystemTimeAsFileTime GetSystemTime GetEnvironmentStringsW CloseHandle RemoveDirectoryW CreateActCtxW ActivateActCtx FindResourceW GetWindowsDirectoryW LoadLibraryExW LoadLibraryExA GetACP LCMapStringEx FormatMessageW LocalFree GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity GetProcessGroupAffinity GetProcessAffinityMask QueryInformationJobObject HeapAlloc HeapFree CreateFileMappingW HeapCreate GetProcessHeap HeapDestroy SetConsoleCtrlHandler FlsAlloc FlsSetValue FlsGetValue GetLocaleInfoEx GetUserDefaultLocaleName GetModuleFileNameW CreateFileW GetFileAttributesExW GetFullPathNameW CreateProcessW GetCPInfo RtlAddFunctionTable CreateNamedPipeA WaitForMultipleObjects DisconnectNamedPipe CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers OpenEventW ReleaseMutex ExitThread CreateMutexW HeapReAlloc CreateSemaphoreExW ReleaseSemaphore OutputDebugStringA SetFilePointer MapViewOfFile QueryThreadCycleTime GetStringTypeW TlsSetValue TlsGetValue GetSystemInfo GetCurrentProcess OutputDebugStringW IsDebuggerPresent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetCommandLineW GetProcAddress GetModuleHandleExW SetThreadErrorMode FlushProcessWriteBuffers SetLastError DebugBreak WaitForSingleObject InitializeCriticalSectionEx DecodePointer GetFileSizeEx FindFirstFileExW FindNextFileW GetTempPathW FindClose GetConsoleMode LoadLibraryA GetCurrentDirectoryW WriteConsoleW IsWow64Process CreateFileMappingA GetNumaHighestNodeNumber GetLastError CreateDirectoryW WideCharToMultiByte GetExitCodeThread TryAcquireSRWLockExclusive TlsFree InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent RtlVirtualUnwind SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalMemoryStatusEx GetLogicalProcessorInformation K32GetProcessMemoryInfo IsProcessInJob GetLargePageMinimum SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock

advapi32

LookupPrivilegeValueW RegGetValueW SetKernelObjectSecurity RegQueryValueExW RegOpenKeyExW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW EventRegister SetThreadToken RevertToSelf OpenThreadToken EventWriteTransfer EventWrite AdjustTokenPrivileges

ole32

CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal CoRevokeInitializeSpy CoGetContextToken CoGetObjectContext CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CLSIDFromProgID CoTaskMemFree CoReleaseMarshalData CoTaskMemAlloc CoCreateGuid CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoGetClassObject

oleaut32

SysAllocString SysAllocStringLen SafeArrayGetDim SafeArrayGetLBound SafeArrayDestroy QueryPathOfRegTypeLi SysStringLen SafeArrayGetVartype VariantChangeType CreateErrorInfo LoadRegTypeLi SafeArrayPutElement SafeArrayCreateVector SysAllocStringByteLen LoadTypeLibEx SysStringByteLen SafeArrayGetElemsize SafeArrayAllocData SafeArraySetRecordInfo SysFreeString GetRecordInfoFromTypeInfo GetErrorInfo SetErrorInfo VariantClear VariantInit SafeArrayAllocDescriptorEx VarCyFromDec

user32

LoadStringW MessageBoxW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

strncpy _stricmp _strnicmp isspace wcscat_s towupper iswascii isupper iswspace strnlen _wcsdup isdigit wcsnlen islower isalpha towlower strtok_s wcsncat_s strncat_s strcmp __strncnt _wcsnicmp strlen wcscpy_s wcsncpy_s _wcsicmp strcpy_s strcat_s toupper tolower wcsncmp strncmp iswupper _strdup strncpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __stdio_common_vsscanf __acrt_iob_func _set_fmode __stdio_common_vswprintf fflush __stdio_common_vfprintf ftell fseek _setmode _dup _fileno _flushall __stdio_common_vsnprintf_s fputs __stdio_common_vsnwprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fgets fgetc fputc _wfsopen __p__commode fputwc _wfopen fopen fwrite __stdio_common_vsprintf_s fclose

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _beginthreadex terminate _wcserror_s abort _errno exit _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _controlfp_s _exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo

api-ms-win-crt-convert-l1-1-0

_atoi64 strtoul atol wcstoul _wtoi strtoull _wcstoui64 _ltow_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode _aligned_malloc realloc free calloc _aligned_free malloc _callnewh

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

acoshf modf atanh acosh cbrt asinh atanhf tanhf _fdopen acos acosf asin copysign copysignf ilogbf trunc truncf asinf atan modff atan2f atanf ceil asinhf ceilf cos cosf cosh coshf exp expf floor floorf fma fmaf fmod fmodf log log10 log10f log2 __setusermatherr log2f logf pow powf roundf sin sinf sinhf cbrtf sqrt sqrtf atan2 tan round tanf tanh sinh

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wrename _unlock_file _wremove _lock_file

api-ms-win-crt-locale-l1-1-0

_lock_locales _unlock_locales setlocale __pctype_func ___lc_locale_name_func ___lc_codepage_func ___mb_cur_max_func _create_locale _free_locale _configthreadlocale

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

215B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

225KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HFkiller_full/HFkiller_full.pdb

SHA256 99d2e0b13008664b1bab2a705c23c511f61a9cabd2941dc57438f068c673977a
MD5 447b1be740fcccfc81595e0e8c206deb
SHA1 8bbda8e15687a1878e5f241377659a2eddd9b1a7
SHA512 d4cce6421337ad20a51ce26c35cacda31d6d10d69a86c42f28fce5e6a39585359639f5fb24027f6842370a387c3c3134d4e7f09541daaf0ac50a2213e76ffa53
SSDEEP 384:PVIadJbD4SaTKlh+Zl9Sp3d3UafsrrKHQfx8hMfHsoaV4K1dL:PVIaMlyzfsMVJdL
TLSH
T1EE62B433E348D660C543293684B2C28C7772D324A745DF76F2C82665ED9FB8887F66A1
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Certificate.format.ps1xml

SHA256 031bdb9c0a1b9f05d3916d6ef18f9e85446c5aa903040df3a6d0c773014770c3
MD5 e6fa887396e50f1f398dc6612fb60a3e
SHA1 23f12de672616abb861d5eeebf0a203c831aee94
SHA512 412a4aa02ddaa131fcaba54d1545b84d7a9d7b7b589758b63c04733eb1d32f967e0c8864bb66ac2b8ba106422a364cb2c1ac86394c0b55cf1b8310343968d6bb
SSDEEP 192:XyHd6BFjItaCXqbxWBvE/kImGIR2//+K/:XmKFS2xAmkImGIR2/+K/
TLSH
T1E5427B4AD2E07FF019B1452AFBA9A5D5DE14930F086B2650F2DC7B0B2FB9CA54133636
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Diagnostics.Format.ps1xml

SHA256 95ebb76eb0cd0db44c293212e137aa3f0ced2c579ab218137f407c06f2fb8194
MD5 c713fd615034119f2e74dd9875a41796
SHA1 312ffdb56a11c9213377dae50b2a882e77399f15
SHA512 92e3d2795e852e2c42950b36aee8d17b59a44007ef259ed6d301e1b4ad0532c9acc186382be2188351228872cc18d59194926620eda345ec2e299efcde552ea5
SSDEEP 48:fJBJ2QlBVtq0svUlMaSLkKRMXhXIDk+kw1+xXBJ2QVtD44yLkKkX7/X/l/XIDk+1:fPto/Tk7louJqkllo3j
TLSH
T192A1AC4323EE511872776A5D3E7248B48F2BB921297DD9EE10AC304ECFE7E1285517A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/DotNetTypes.format.ps1xml

SHA256 6acf524521b667fbd4472d0f207b2d5dab908b1498094601f5095c49ab1e0130
MD5 8b23dee4d1464cd2d58de299319dd4b3
SHA1 937d6580114e1d22cd1b3032c68da7b9307eaef9
SHA512 daf243a56db773681e777a933fa5051d527d3994ec38589026f6998462f405fd241a72aca9ee17cf354d47b53a65b8e06677d3e2f3146e8f143df93092852aac
SSDEEP 768:omdlUXWSKDPI/QH6HU0xwCW6HUR+VwuIpQ26r171P1iR4OdRXwh4yHGElG90Rqa9:DaV0dVo
TLSH
T154D3C50F53D03AD64976C44AA6BC666ADE20611B1C6F7AB4B7DC830B2FB1D168133937
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Event.Format.ps1xml

SHA256 9a5e2b8a297fae8c9f24ff1a5c13830442a5c490eff939026c5d29ec33255192
MD5 2ed53401bbb77ed6089ede39a6d7d7eb
SHA1 e6f8baa878810f1c5fca2e7c06263a27c3791249
SHA512 f0c86fb7da3641f0eb8a913e8adbc1a925d39c46b736c18d5baed1621c2da8969505387916e614f670f130171be9e37b5cb648814d8d2f28252b5c296e53991a
SSDEEP 48:yyDtJAnqQV+MWQK89y3gyL0y9X1XDX7XoDk+kg1exQAnqtVQPlXPybyHL0l+XbX8:dt7fl0yPl4dYPln0lIst46Vr6oj
TLSH
T19A229A4323EE5118B1775A5D393388B44F2BBA21597DD9AE01AC304FCFE3E1296507A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Examples/profile.ps1

SHA256 9f51461c6bb0fa44dea4b80d3bfd23e266ba2592e2f4c29d004c7f01a14e078a
MD5 8624762990fa5970a2cb25cba70e9ad4
SHA1 30e18f1bb325f85290c85131fc2232c141c8086f
SHA512 2dbda62735c575cae5fbec87405fe9d128f6797b4710c3ca14232c6ce6509910e122e8be04a1e8168e90a7a75750889cc2188132bce146ff76b981e86b9deeec
TLSH
T18EF05CDCB5039DA52B783F5A34013E1020A67156C8B95F8D04B6B2C5E12FB5E46FE411
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/FileSystem.format.ps1xml

SHA256 38ad45871b7d47d4bf1cfbe1d7d0a8d78fc1f0dd4dee2747d64aa6d1297d7a96
MD5 8f1b890ade25a9b8b119b42887d561e4
SHA1 5bc84f859cc0def53fdaa8128438fdf4fa7ff4b4
SHA512 020fd777f79b5158a1364321ccbcf3597185ad51107bce511386ef599c34585e1b2807cc5b4f1b4b766f4e0015ef84772eeea9a59e8e0283dabc575729aabff1
SSDEEP 192:N05fjwIcfD20klGb0/Sv0EwXlVG70qlqj:N05fEvFWGyj
TLSH
T168B2E24363EE5508B2B76A5C2A37C8744F2BBA61593DC67D02AC304FCBE7D1296117A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Help.format.ps1xml

SHA256 21701fbd643a1c8246989a9aefd43afb07ab0ae4de5bc65ac3ce36dd1a785768
MD5 fdf795ae64b823fe2dde2a443f1d34f4
SHA1 cb572b08bf448a9d9fa0ac2ad8f02b5c338087a6
SHA512 34933193753139daab930d18ce287fe296407b89104f69414ea84386a51f4ec0e1f6b53440ddda6f77f16962d5c925a443879b402e5517695e5774839533acbe
SSDEEP 384:XmQXLIL0m+6LQLeLblZqpGhdd0ddZDCQmw7rzp:XmQXLIL0m+6LQLeLbipGaNF7rzp
TLSH
T1A7933B2552F04FB40DF5087AB79CAC52DD2693A718618299BECD2B570FF2C61B873932
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/HelpV3.format.ps1xml

SHA256 b89c3b982c87290debbcd5fd1424a161eec6727aeb2ca2ac5044b4fcfc441c70
MD5 1ae3d78e3f382777c572b1dcc883324a
SHA1 c67bb571161e0f1a6738c7b0a38c05e2ddee6ef9
SHA512 bad1bb99368f991f7996db1cfddece5639361a58ee3b938c4af68a15a5ad80b6046f1edff8c883341d3800430c81069690f64f84526e89561bc0201e42f4dafd
SSDEEP 3072:DY20020CeUDo+i+yreUzFeeU7aeeU7pGeUz2:N+yzhwR
TLSH
T15FD3292462F04FB44DF50476F69CAC52DD2643B318628299BD8E1B674FF3C61B9A3932
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/AppBackgroundTask/AppBackgroundTask.psd1

SHA256 ad52dcce99fb4ba321539a2b4f0a41a4697d4a5acccbd579c87304ce112dd789
MD5 a435337450cca0b15e2f7d0a517fc196
SHA1 f39825a759eeac97c45c392d67ffbe769e773631
SHA512 f4773ffc5e5c5e3bb07511102a86b8f0f8c3168c87b4dffdf04085d046ec461825e1a7e927bcde9ed4604063c69ecd064b0e27825bc3623060e50df8dd29bcdd
TLSH
T1391176F245B9084A363799A2547C0C08F2EC2F6B9226860E7D3D7B680F33E02836B455
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/AppBackgroundTask/MSFT_BackgroundTask.Format.ps1xml

SHA256 2306d7187dd8363510bdea30286f94c66d79b7d49839127bb3d8ebc0a5c92931
MD5 ab0750d48cecbcb02a7c5789dfb48fea
SHA1 bea351f2f8865b324e4e2675036d4ee9d041cad4
SHA512 baeb2b726ed2f606250e0951c16601eec4d067fde658b15eaa334affd21221335458d8b5f63a2687afb8bbaee8dac9b4b933a7f41b9a7d0824f43ccb11630886
SSDEEP 96:bplm+SNWfS5WdSTWpUyPPmySNW9S3WrSTWpZJN4Drt8SJzp2SrWSDWrs2:jmGjmIDN4D5zplSF
TLSH
T1A30286C07FDD9E8A52B3060B5A312054DD7CF53B204D68A0BD8C4A9BBBEC454BC5FA62
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/AppBackgroundTask/Microsoft.Windows.AppBackgroundTask.Commands.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 74c68aefe849f0a20571c41a2d7fa676b2046c5bb391add8442c1910703c9d9a
MD5 f0570c4f0e4dc2942b188a5737c4a880
SHA1 5f6bd9368bb37fb84df8d793a627083c73c14068
SHA512 4e32da8a946d8b2f9aba9e26244c52ef836c596815572dc630f23008cbeb45ddd4ab8e79c4d778da8cc39363f758483b97844f3d08202e78e89b69e6f977c501
SSDEEP 96:ysNvCabsjY8ASBazyUdnj08r6wa63J8Kb0D6H61avTpASKx0I+DzDYVkIbL/tbLC:dZbpdjgBybb4f04ZIzV2Wy0AW
TLSH
T125025190A3F8062AFAFF1F767C7646155AB77E52AC33C72D1044920A5D32B948A31B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.Windows.AppBackgroundTask.Commands.pdb

HFkiller_full/ps/Modules/AppBackgroundTask/PS_BackgroundTask.cdxml

SHA256 a742e5566f7995c67e0bed3a57e2132b86b2b5145b77a2ceb0b05311cf210d8b
MD5 4bf10ae3558ae24cb8b43e50648f7a15
SHA1 9cb88809119aaab49b97ed51f485a4a995e673df
SHA512 c3d3d3b4bee302f8b2120977ddd8c7ccb1dcb24661836e7e47b3acb3e7f267ff8dd314cce5ef0ef2039cefc929933a1aeaaf9ec68e3a999579ae62137680ecbd
TLSH
T18B51752177C65AD146B260286165D8B0DD7963C3716C0844B5CE3F0BAF3BCEABA63706
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/AppLocker/AppLocker.psd1

SHA256 e77667408440f70b278c4ad101ff012bffbe4340567885a7187e9b49da664152
MD5 b256cc30236dd3644edab6ba5be79bf0
SHA1 fc27293d9ef98e98529e08e2d20993b80c4cbe1d
SHA512 d40f4d7ddd2ae8d2e32a022583bc1ffc2d3cd0d1df2bbadb11c303ccc0ec0d68342bdb44768d3c876149eb637c80ee8875884488db37dfbd4a5212699b3b0fea
TLSH
T1D411E612A3FE1710F0F65A91AEBA2C356E3ABD246C28D99C20504D0E14F5D498A72FB3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/AppvClient/AppVClientCmdlets.format.ps1xml

SHA256 e742a405fae2d9ea37ae7b16e9866afadf75b1dde2940a520aa0417dc5f91a52
MD5 1f2a10fb3af5dee4b300fe87b9f2b762
SHA1 26d4f4beb82b3ec969e7b579e34512aa2fddb265
SHA512 4e43519697d1e4caa161fabd1dd1f35676d390e06b9a817829a87e15fab7e77b6da23d63431332f18d6269fcb28f653f61da2490a0a305bd9ee0008d5e7a4959
SSDEEP 24:2dnSZ98iDOF0hRnWL0dKgwRKXnwUCDL0tS4TOcwB1gJQOfQP:cnSjjDEeRnWLFgwsXnkLD4zwBCQOYP
TLSH
T1A191C20B53D43DD74276854B56B892EACD65902318AF7AE5B65CB3070FBDC068733A32
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/AppvClient/AppVClientCmdlets.psm1

SHA256 cd32996ba34772f476b8182ef2ceec35db676a6b7ef464a4cfd19711d9008f5c
MD5 a7707eb2d7938e7e976eff010a88bf65
SHA1 d6d6656aa3375e35cb23f95662b3045142977d9a
SHA512 f8b1e999b82b05de589a4108d7245f60e3fa521788dad5de54e4a39994ad6ccc9f729d9ca1df4720216876496d8c23adbe54ce51b3b2a0f1f9dde760e6640962
SSDEEP 192:Z3sCPT+34NyH/g8Lf0FIM4/5e4jZTjlwxjaCpK3CpK9:Z3sCPa34Nyfg8Lf0FIM4/vjRj0jaCLM
TLSH
T14CE11F793788439401F72A65BAB5C012C93A13A7313E6E10BAFD58C41FB7915EA2CF5D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/AppvClient/AppvClient.psd1

SHA256 ad9899ce95f910745ae61af63a4019cc6f14de5212650c13726050a6c12dac95
MD5 688db1c53ac6df0854cf9fb309c422d2
SHA1 1015e1f5558bbb802be436fb43ce2ca481e1d326
SHA512 57083cf15e0d2a6ed9b526f4946bfba1291f6bf6901bcb815a16106e7d51e24ea5d433f8ccde9426cf8b7efb06cc1336d1aeedc08a928311171e168a328f6d1f
TLSH
T17A017BBA422E7857B5963697E200C311F9AD47EA443BCA717AAD82C803C35E9C35916C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.AppVClientPowerShell.dll

SHA256 03e319b2c4e517445475d7b7a919cbb45a82938776b66c1c1ff35c72be2d8ac4
MD5 d06a1e84694bb6a8a45ce1675ed8dc0b
SHA1 c4c50e469f0d4613e57309186fb70838589512ce
SHA512 32fc4dde36d3a082ed6ad83e977e3ba6c22ea4920a7908a3a361d4ef4dfa46e92040ad3fb63e1fddb8ea20893b6082d6d865fe220d53d2f2f328527359d7f01b
SSDEEP 1536:xlhm7VVvHtAl7aKtqsPlHE55/V8/qwD/Pnryl+fyO3JP3wbnVdoqx3QHRdmpPoBV:xDeVvhsdHEXoPnu/WJP3wbToqx3a7mu
TLSH
T166B33A90B36C576BD39B8A7CF06484220739EE41362BDB6558E0F5DD1C63B849B123BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

4d:60:c4:f1:09:16:05:20:aa:f0:92:7b:ee:bf:ce:a0:72:2a:a7:cd:84:58:28:d9:dd:51:f6:ce:83:89:77:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2019

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.AppV.AppVClientPowerShell.pdb

HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.AppvClientComConsumer.dll

IMPHASH 44968780a42a44c448cd91b3c75c3966
SHA256 cad5235fc8ada4f743e6de606f187ef9049cc3ef9a5b58f8a3a55530aaf8d552
MD5 a8a98193426da75e34bc8b27e2ffbdef
SHA1 e8b0721cdf1340df537e9115184716a9b5091c74
SHA512 71dab1479a775d9023afee618f1da5efad44d6a7972f72405940b14fb2cf7453a7af35efd8def5d5eedc23346f74758404fa51c73e3a1403fa3de44f4ca30076
SSDEEP 12288:WHU8V5+0r8SXGNUbTizUxhlUbRjoDBTb+gLSKf/jrXcy+tieJFWOihNxEEOVmU8c:WHU8GzqDBTb+gLSKf/jrXcy+tieJFWO4
TLSH
T104F41AB6AB934ABAC3BE1A7E99B3C31197B5B421430281C7E27461191CD33C8F675D72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

47:f1:0d:7c:5d:74:64:91:58:06:49:8a:4d:f8:c6:7a:13:d8:03:23:e6:b0:22:cf:e6:53:d6:e0:57:7a:7a:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2019

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

10

Entry point

186917

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.AppV.AppvClientComConsumer.pdb

msvcp_win

?good@ios_base@std@@QEBA_NXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configure_narrow_argv _o__crt_atexit _o__errno _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__purecall _o__register_onexit_function _o__seh_filter_dll _o__stricmp _o__wcsicmp _o__wcslwr_s _o__wcsnicmp _o__wsplitpath_s _o__wtoi _o_abort _o_free _o_iswalpha _o_iswdigit _o_malloc _o_terminate __C_specific_handler _CxxThrowException _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy wcsstr strrchr __FrameUnwindFilter __CxxUnregisterExceptionObject __CxxDetectRethrow __CxxRegisterExceptionObject __CxxExceptionFilter __CxxQueryExceptionSize memmove memcpy __std_terminate __CxxFrameHandler3

advapi32

EventWriteTransfer RegOpenKeyExW RegDeleteTreeW RegCreateKeyExW RegCloseKey RegSetKeyValueW RegQueryValueExW RegSetValueExW RegGetValueW

kernel32

WideCharToMultiByte GetDriveTypeW LocalFree GetLastError FormatMessageW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetVersionExW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetNativeSystemInfo InitializeCriticalSectionAndSpinCount CloseHandle LoadLibraryW LoadLibraryA GetSystemDirectoryW Sleep FreeLibrary RaiseException TerminateProcess GetCurrentProcess GetModuleHandleW CreateEventW GetProcAddress

normaliz

IdnToNameprepUnicode

oleaut32

SysAllocStringLen SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SysStringByteLen VariantInit SysFreeString SysAllocString VariantClear SysAllocStringByteLen

wininet

InternetCrackUrlW InternetCanonicalizeUrlW InternetCreateUrlW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoSetProxyBlanket

mscoree

_CorDllMain

Name

.text

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

1024B

Virtual Size

992B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

495KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.ClientProgrammability.Eventing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5fe32be6aa14df923da9e7fda752c0ce48b97137274baf8f1798f12fcecd6bdd
MD5 31fb5298ff5db857fb6fb4f1a58bac9a
SHA1 02ac2626d3c78ed3fd8beec1f0d98267bc994592
SHA512 2e9af5f6f86ed34f92848ddb756d6e7aafc48d4ed1db995d56690d1fd02c1eb30f1980ca87a7ae383439fbc7d5b0d9bf246f1e0ff82fe30ec6e678d9ee4d7c22
SSDEEP 3072:3x9/VwXFoGvFbxM+HHYq8ajY5P8B43z3asLTd1XqtIroiN9kFUMG0QxgjnbMTcEq:jeXFfvFbxM+nvGO43z3asLT0
TLSH
T1B804CF87C2357A06D44F0E726C178B42A596829DA2845C4FEFDDE08FC5A4EAD6F103B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

45:e3:21:c7:08:83:f5:aa:df:7b:06:3d:6b:6e:71:dc:66:31:77:10:13:e2:30:32:d0:04:2c:ea:c7:1f:bb:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2019

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

169926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.AppV.ClientProgrammability.Eventing.pdb

HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppVClientPowerShell.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 39d9a10650b1c1c43cf9ff37735b6abec0b42b43752c7b6dfd159f3d11107c82
MD5 7117efbfc18d39cfd773a7946246a37e
SHA1 6fc690fed8cbcb9d196e2426950c9620fe116079
SHA512 32c040c61dc283c352b7f83bd6b1cb58d8d4a3d9d2d73a8e22f10cf033cf7654ca79d0b038bfd580601aeed873234445a5594c22018a8291c4671a9b72339fd2
SSDEEP 192:WjQWd53+vFIeqkptH6I/nhB7jGhDjW70W:WjQWqvdpTL/h1ChDjW70W
TLSH
T184F1954263F499A9F1F75FB49AB78954EA3FFC32AA34D61D0990060C5C229805DA0F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppvClientComConsumer.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5eb6f31f731fefb0fabcf717768dcb8eace23a615b1fdf040a1858144e3238e8
MD5 c31a231ccd1ef576ff63e0a9f258ee8e
SHA1 501420443b0cff183213aa29b876c199c03a1b45
SHA512 58931092a99e8a4cf8b9c2b1a8a6f5ee9356daecb6acdab6517c29f1463ab280d2ba98d356d827913579632e73ee3116b2abe6e1e4bb6cfd3921f12894a87101
SSDEEP 384:5hH4/jxkjomGQ2r3kp06snBf6jyMBakzNfjnzQJiZT7WRSW:+XQC3kpaSDQkzNfjnzQJi0
TLSH
T15592D70137E8DEEAF0F70BB49BFB916BE12AFD366622C05C59C0570E59249814E6473E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/Appx/Appx.format.ps1xml

SHA256 a9428f01a42ad39e53c0f26345563cda3c4e5c42444598819f8d9c3c8e697b86
MD5 3833600c604d36a91570a1079c7d5eba
SHA1 cf6519bec45d3ca40703cd6fc30429acb06a320f
SHA512 4fab68b2a160ce695c01a043e3146d040036dcfb180cee67f5df77ed1fa23b4f07a3679da6ff66c6d24f5d3c943484cfdacef49cfea7a85d6b1a42da73b7158f
SSDEEP 24:2dnQstO+xWQJbmm8PLYt3AbKCviM2uZoaxGGgZEM:cRZRbuYtjCvhRsGOj
TLSH
T119B1604AE6C43E956DB6841ABAE9B234DE50531B4C3A2450F3AD4B0B2FF6CA14533937
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Appx/Appx.psd1

SHA256 8bf4b9e9d6f45570f2de2c063e5d900c112bb30f970e18b52fb5fb79986752fa
MD5 d00de325b5c93cc48eb5ce8ac8faee3e
SHA1 e6daf9fee1f146b48b37d155ce0298bd13e033ae
SHA512 863f5b30883bd97cae97a640e37764b543d4537854fdc999773139444562b1cf0b5a5a4a322664e9e9a4f833144a0170e3590549172b2548e5a861977488f691
TLSH
T1A72129AD07D546C9527E8A4B72E9A809E16C2FB3E4135AC2737C11C84FE1A53C7835BC
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Appx/Appx.psm1

SHA256 803c85d5791301e7db218a0953bcdbbd362671f38699f5afb6497a890ac6a2c4
MD5 2614010db06cefec4f7cd5474862b00d
SHA1 1404e610c191fdd03865336dd6ac8174e4411d65
SHA512 a67d86757a29e04a33c931bc78cb36ef2d302491cf7d1886ede72f5ed39dc82514a7ff44a6a742d48a2d8b64e106bda3e75197c75058b49e89d7e1cad4b30dc9
SSDEEP 96:s6emk04syFnQE9YlM0kjNj38jHZPY49Ylf2n5QPPI9YlCYQPPI9IVfOI9wc0Yyol:v8PaMr8TZ7aGa7K9ucN
TLSH
T14FA11064D72C9787A07F5B5FB6574804E90A129771185E6037EC0FAC8F72762E00AFAE
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Appx/zh-CN/Appx.psd1

SHA256 7d8e46f8e056a963d170a52cf5511d6ddf18db3aadcd1bc106b36c800316a6b5
MD5 7d5b64094d4429ee3e62f66853bac067
SHA1 9032bb7ae7ec7fc525322051647a000dc31ced79
SHA512 d2c64a2add1b0178ac72f1db1f404ce44fb49fff7c424284ffb9e086b208049a118222a3deab9c52def4783b42cce059e5c593f69d4bed0f822e81e45d050d3d
TLSH
T169C02B306CE008C96A404B18033C5CC453381DFF41E633D295C7CCC80D415C04124BD6
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/AssignedAccess/AssignedAccess.psd1

SHA256 2bcfa8ca478bd083a46456a6bf993bfe50b9a92851187a77c0bc91ace316c7a6
MD5 258db7b2296328408b2fc591b6925179
SHA1 a1ef08ae831942734f2ce7a14e527553460cd5b4
SHA512 3afeefe64c523cd1d9f4e7255106784ed69cedfa25bd95924a7ea68df28a6bdc7348e7512f9adce5067454921b20d6aba70a2af77a222864a6398db1c2288094
TLSH
T125F09ED79414A443A5373437D150C818F7BC5FE524A4C91DC44F5741138EA15C35F060
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/AssignedAccess/AssignedAccess.psm1

SHA256 b4247c8500b73e30c4e523a110c9ebbef6e6c8663dc9b9233d9ef0c6d1867e38
MD5 3e38a11d1f2cfdab23b2be8ed72bb152
SHA1 a972e9141e4eb823b865dc42a486cf76d6ce3758
SHA512 71c772f82b6225bab02ba2af78818f49a6776170a0ecd9b3aa23e52fedbbc2526a0e862eabe59d44e145042b4d3635efc0ce95b3cd0674e645a2e84bc40055b8
SSDEEP 384:+oFyXPXu27XD8lwsr2vBYhy38xCSk58A2XjF:+QyXPXuoaws2vBYh48xCv58A2XjF
TLSH
T11C52F8959B4202A8063703798E299258E9D9003793FA02A1FCFC4E515F3A796C776FCE
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/AssignedAccess/zh-CN/AssignedAccessMsg.psd1

SHA256 b77cd3a5acc438a3e7cdfa82ce22200cff3cdfaa340b83737697b2cd975d39d9
MD5 5e62d92b879fca3b37736b8ffe87586a
SHA1 f671f0043b337578ec4405749cb7994b3f194619
SHA512 910d4d3d329cd9b61038376f1fed60f57eb0edec003d5b9ac01a5abf633da0efd96c393975b27476aa00609d978d3d6ff061c59180bf492bb3288e188cf20efb
TLSH
T12651058253F85108F2B76F48AEB966220E7ABCA26C7EC16C1184402F4DF1E44CC74777
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BitLocker/BitLocker.Format.ps1xml

SHA256 3c2c92a8a68795d13565610906665fdfd709dfbdbd3d0f6be91a9d40a93f0521
MD5 e39046c77784240fe79cdc7e61e5971f
SHA1 e6c1da119db4ddf6285512b66278697874f7016b
SHA512 a4ada1bbec94fb8d425f0f256a1f0db142ec398e7b73fa45f9ec06290fb8dd5890677e07687a5d20a30dc65b67d63c3396c440d502136c081ab0c2a58e93ceaa
SSDEEP 48:yc9u58JaVfVMoMMXqf0sK3CsfDSu0S7SyLklXxXBw7SxiX5hXJXwXPXIDk+kw1+l:N9Y69MpDo8rkO7S0Clof6
TLSH
T149C1CB5323EE5118B277665C3E374CB04F2BBA262579D9AE40AC300FDFE3A1246517A7
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/BitLocker/BitLocker.psd1

SHA256 71424926fc618be21b973efe13613a309ac11f8b6e79152c7967e34b399b032a
MD5 cbec92710e63fe208f260cce1be0271c
SHA1 26919079f5fd6efcbcdba0de885411af497edfed
SHA512 1b7241631c7d324f0cc3b81cadf83b2e2b6ceb436d9937daac99402f756406a3e2bb94831ad0c998c3b80fd121427435b64a056bdb624aff3a164a801daa553a
TLSH
T1B8313E81E7F95200F5B24AD49EF518754BB7BA3D6C38DA2C0240C55E13B4E838A65B67
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BitLocker/BitLocker.psm1

SHA256 4eba78c09444d48eac0699a2bf6a42792c5aee7abd7b36863ebd77a18bf4c929
MD5 5cdd4eef269333f031e7c00f7ce049da
SHA1 27f87466d659fb4d9d3d8582153dabb39c3097cf
SHA512 daa1fabe1b744c69bbda6767d1185f5b27229d3913210686b6e968672992148824b263356e737ff5317e0f02ed67751d9fe2f64b19617eec03096afa14420a75
SSDEEP 6144:4DZDT92TT3Zl0ZRmTwYyKouFCgcNPEHjKz814TjWz9N/6B//n0M4mrFGgcN/8H3A:z
TLSH
T1A7545C42A7FA1108F7F767896BBB45700BB73D666978C54D15AC608E0BFFA0089217B3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/BitLocker/Microsoft.BitLocker.Structures.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8132b71867d55483b348e10b39876c9afb64ee31ab6fcd3a08da7e741e59c74a
MD5 9af977046d4b247c5be52bf1790d77de
SHA1 3bb75274d2d64617e207aa9fa024e8e4aea12fa4
SHA512 6e0c39b945f7761812a4b013d1a39041c919226d514b723674a6580d3ab894f1d2401aeabff30703c7f7e628530cda3ff52a329af1bd0cb9ca337988e3c1e8b2
SSDEEP 192:Ax5wFdaBEj4864Sv1FqqUxeGc343MN0rQWtkgA7+W:Ax5QaBE1KKoXo3HQWtcyW
TLSH
T16332F95467748BBFFDD70970AC62861122765B891633CB1A8D29A1CE7C0AFC6C711F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.BitLocker.Structures.pdb

HFkiller_full/ps/Modules/BitLocker/zh-CN/BitLocker.psd1

SHA256 90292be84f7b1fccec60bb3a335a0e4cc6b08aa4b2ebfc8750bfac24e6932818
MD5 e8a1ff3ccaa16cf6a5ee9b9e059a034d
SHA1 7cb3b2ab110a082232dd3ec1beb74f8bcf0c0616
SHA512 ed064478832fb7aed1760ff9aa026997c671a6ecbcc0813a1d35d062a8734ef7fbea8de8613f34c269964524425a230861ff9c912529d8714d20460dc3c90ddc
SSDEEP 96:giaf3MxK7IOlKlIgXOlKkIgQpDYBMAvpy0xO4LIgiOtIuvA4rTjZcSAC+OC4:giaftNxQRDYOAvAzr8OuvA4rTjZcSACh
TLSH
T1E1A1FED06BFE09D8F0FBBB805BF66A21897F78219A22D50F5584525F0570F01A91AB3F
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/BitsTransfer/BitsTransfer.Format.ps1xml

SHA256 ba5d93362b52f8831e905601514f3ad0ba655a3f82adff18206cccad0bc0b749
MD5 8541b1a39c6fd5f6783d80e02b2a5416
SHA1 c4c9d711107850f3412d799bfe9ec1a58f3cb5a0
SHA512 e552b33e551166f7b146b1e8060d0ded72384d37f026b8f985bd0d7bee14f10eed3fc54c1aee2018e81ed56d682f26341aa88f7b07811449f8806d7a27d5b3a7
SSDEEP 24:2dB+DJg+DlyeYM+DJg+Dbgm0FrVQ7Mhth5OYyxSdM:cBkg7e1kgdm0NhthVyxl
TLSH
T188B1F30BA6C42E852DF59429BAF8B664EE10530B9C7A2550F7AC570B3FF2CA5007353B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/BitsTransfer/BitsTransfer.psd1

SHA256 fc334e622ee606fa34d302b1f43fb5ebb9c5e798aae06c7e0c51d2e6e72ff39f
MD5 3316f11fcf813c2374c31c1de5392346
SHA1 692ea078b3dbfe9d19df488e30fe8ad4619ea6c2
SHA512 bf04b0899bc412d50ee49975dca36f4dfd48601b188b65eac32e8d450a6e74d8bcf98e1249f3716b6118d6727e108d2e90f3f28a58121f70ab304d703bbc1bc6
TLSH
T192319412A7F50750F8F32FA0AEF458365A3A7D566C1EEA6D15500E0D16F1A08C472FBB
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BitsTransfer/Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll

IMPHASH 1dbbca97d4f5306725f8c5a0c2304d0c
SHA256 a5d8b2428bcd2900d0bea0753fcdc778424a83bde42454f2e85bf65595825e60
MD5 98dcf94a978bf531dc9e1ade3f4a8243
SHA1 7d6585868370b50a7c50467d9bb551e28f69c994
SHA512 1dbcf95c117920b48035e48367674dade8ec148681b78223061ef563a7e7b893a09500c67ea68fc0868a2aa657df87b6fa67cb13950853a8932ed96e48949388
SSDEEP 3072:4frGlPCaDEGDxTgVH5i8V/EHlPIKgAAz:4SlPC1GVTgVHss/elPGAA
TLSH
T1D3B308661B418F6FFA9F47B5B4B3AA19073691C2AB91E3CF5000936928563C4DD323E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

48430

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.BackgroundIntelligentTransfer.Management.Interop.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o___stdio_common_vswprintf _o__callnewh _o__cexit _o__configure_narrow_argv _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__seh_filter_dll _o_abort _o_free _o_malloc _o_terminate __C_specific_handler _CxxThrowException wcschr __FrameUnwindFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoSetProxyBlanket CoCreateInstance

api-ms-win-core-synch-l1-2-0

Sleep

mscoree

_CorDllMain

Name

.text

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HFkiller_full/ps/Modules/BranchCache/BranchCache.format.ps1xml

SHA256 7cd52e70816111f951cb473c4bea471e731a5dfa4deb4cc57ced7d0cf53d489a
MD5 327ed12b6073800e165b00ff01e3b0c9
SHA1 85bcbbc85e87ada754aa61e99d3aff68034f6372
SHA512 4b0d29b597494cb87d923bc38c3db0caf15e19749bf604e6ec92eff72e1924e75a7227bd276ec5abefaa1dee1fb9f369f8ce2786c678c4c7e7f8a26eb8bb642f
SSDEEP 384:jPVjqjTKHmXrXM+yJy8hXWUZRq2Z7FfK4jUw+LlZLlaLn:pOsZR5t
TLSH
T100C29C19A3F01BB009F4C136F69CAE63DF1A125B48654158BACC1B1B2FF3C6169B353A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCache.psd1

SHA256 a374a6410e60db11c2813e54e481dea41f868b80a1837d17b1045f4137522ed7
MD5 d94f2c7afe19ee3be1b832a51630eb58
SHA1 8f587361623fcc15c53aa8a4c97fa192404c321c
SHA512 51794a90ec2aec9c551235d1c98afb2429f527dab55b7806a2e3d2cfa032e8fdaa9fbbaefe68988f3ab47cf3dcaa477b681686bb3750e779d40313a31d5781e5
TLSH
T1D23142DB6F102E45953BD772D5C4E4A2DBA43F27D0A55AB4B51A43CC0BABC7003B14B5
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCache.types.ps1xml

SHA256 0214cfb03a45a95bf041d1a50f93dc22fedb716829e75d3e915b885f855324be
MD5 2548b4e986bf7c8cb64c0eb5b02ee918
SHA1 47a4ff85760e07f6bd774e74333de00691461d06
SHA512 15016109f53edf2f129a235473c91a6ce48cb749da2e6b7495a644bb0f310f10b911cd6dcc981729063b3bc78c7b0f40d0cbe6fe2fb0dd3c5be358e0e9757e3d
SSDEEP 96:yiPw5kmPw5li0pZXQm0pZXBJF6mSPRtF6mSPn:vojo09SPV9SPn
TLSH
T16FB17D70FBE9C4B0C2B9D227FE36E864DE11016F807BD169758C4A472B29C889BD3935
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCacheClientSettingData.cdxml

SHA256 f90edd92216e86f7ea6bb1cd5ef9643520d5dbaf294e98a44e241a0b82657ea8
MD5 f79eadb5fc14724c51f2ff7fa6ec0970
SHA1 42b40a547c3e0746da48a60cc38321c1e43daae0
SHA512 69cf84943a263158ac1a48af26493f9bc0cdd57097d36e7df8612c73cf6b93ae637e9444a58196b8b29947ad52a1ac98908a1aaf983995ec48f81116001b43af
TLSH
T10AE02B0053C458DA4577E309D391EC44E755339BC159694DF969EF070F5604AB18B37C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCacheContentServerSettingData.cdxml

SHA256 695349743c236b086562684ef0bf244aab7e4e6981ad98fb1612040c13e88c37
MD5 8206e48306bbfda945cd5310ac6372b6
SHA1 4e2b05ef25fff6b5123f4aac262b4913ffbba043
SHA512 039092c4e38a47a08256932057d1250da2dff50bfe14cd8f66d1a1462f95c0f84b7670730a2c75decc3c9b7bb31150b86fb37f4799bbc66841d027a8724b60e1
TLSH
T1E0F0AB1043C449CA4637E3189392EC44EB54339BC058694DF5A9EF070FE6089B18736C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCacheHostedCacheServerSettingData.cdxml

SHA256 c9c7ff32576b0d7bc0c304fb6b48ec498e89d6090feaaeba2a90c4ad522304e5
MD5 0148ab42073285513059dc37726d27e2
SHA1 67eb6a8655bd272d1fdbb9aba23a27a7745e6eda
SHA512 48e5159e300dbb72ea0b942c1b1218d0540a941076c7dc0d1e0c8903a2a30b87c7b46475d80679720523ed3f5143693a505403b6b4e5a3ade5c279e49cc24fb4
TLSH
T19AF0AB2047C498CA867BD2189796DC04FB54339BC158A94CF969EF030F6A489B08733C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCacheNetworkSettingData.cdxml

SHA256 77b6db163d784157463c178d9a7bade936afb7b19a7613bf4ee9668c0d8ba8d0
MD5 5adb04651a27c9fc04f4f396e4e17a3c
SHA1 a55c983613dbe57a0f061adfe62fa797e8972bc5
SHA512 69b867a2703c671f416176b6a063b4de65e35f12909fee49d18f5ed4ccb923782ecffc26d9d49b810c00c833722365f4078fabdb5e2b80f9b668317b33cc6a30
TLSH
T164E02B0153C458CA4577D21D9392EC44E755339BC059794DF569EF070F96049B08B37C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCacheOrchestrator.cdxml

SHA256 7a83fc9f8f9b3e566ce8024e309d26cf559346b7cda870aace2f84375795ea27
MD5 e286cc6833eb6fd59be00d66e0b72bd6
SHA1 0b7196f9f69350408301e031990e629214b5a4d6
SHA512 34a1b337851795b26b3bbfd65e78771cdd92aaa316a37936f634393de34758a0debfe036ae965099fee2dfa5f3df4824ea1b323d697eb50b65c9a67cf93dcc9e
SSDEEP 384:kDtD2DND5hEDtD2DRDk4DnjDn9DnvDn/DnIDtDnUDED9Dn7DpDnvDTDnOcDnLDnS:H7
TLSH
T118F2DA6563C11BD842B549696162E8B0CDBE42D330AD548474CF2E078F3FEE5BAA3B25
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCachePrimaryPublicationCacheFile.cdxml

SHA256 ba530a1c4e71a38bdfb6d08fa13afc1184267f485c322c803c3efbe80069e73a
MD5 4e8e9971108e80af3abefe7105ce8868
SHA1 aacc57efde66779620131d81e776bcd26f17c1e6
SHA512 c32a49e9b014788ace1ab26dc449602c0bb6d977a4a8c793337fab48526ceffd367d289bc19705549be12a2320ba765747a327ec67542393e5d56594854f1740
TLSH
T11EE0680093D495D68576E21C93A6EC46E755339BC058694CF5A9AF070F6709AB04B3BC
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCachePrimaryRepublicationCacheFile.cdxml

SHA256 ace02a1ae15c0b26e5de01bd4151cf4f141bd7e143eb193d45cb0dbb0db6f467
MD5 21e8b57d3e027de5fd56fc54de612780
SHA1 a929689cc67eef859a433ffdf6afc02ebf36b508
SHA512 8bb09debe9a5e003bf3768cc210782402b890db7bf7d4004d16272926802f0c02ca5733ca2d2641d5cb0ad752518d363bcdee79344272bae012481ecbb6b5a11
TLSH
T1F6E0610453C455C68576D11C9391DC45E755339BC058694CF95D9F030F66089B04F37D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCacheSecondaryRepublicationCacheFile.cdxml

SHA256 30c6d5f7f4826c1349dbd91b0916480951fbaa4b0241e253ba42da6b02810efe
MD5 74d7737359750413018222c256c187ac
SHA1 106701f1bc0b42e2438688f7e1306c19f06fd14a
SHA512 0143a17e34377485504878a7dcb0fd75a11058ef51d9bb12be196f56d1741e58a20114109e1c4430d431afb4de13824f0a26342812a8a9d42e3c159466ff9de8
TLSH
T1FDE02B1053C855C6857AD21CD7D1DC44E765339BD098794CBA9A9F030F66489B04B37D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/BranchCache/BranchCacheStatus.cdxml

SHA256 961c9473ecfddddea46518847db34540cdc03218447596c7e4e8ff43bf0f8736
MD5 aab15a77fc19b89321e68e29ea5c87d6
SHA1 a46621033aea720d8ed6538bb101fe03b20b1e9f
SHA512 c0f625abf00e62e43729c1430046512294663442d326f5b5b3fac1f2ca8109a99449744639d6b2775d1744f5084a27fd31bc6a5f2c1ae89ab4d4ba231f1e837c
TLSH
T14AE0680093C484C6897AD20C9396EC44FB45379FD0597D8CF5A9AF030F6A48AF04B36C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/CimCmdlets/CimCmdlets.psd1

SHA256 c11649524f29913c6b6c2bfdaf87d21d4d04699c71c9a8dab370265786603902
MD5 6bb81320cf2402232021405824f41d8a
SHA1 563aa19714b73e81367160e0f42b0cc4ded19109
SHA512 9db2af7928d4b4bb6d42cd38106c2a1f13cf245e6f9bc48bd20e816699196573c00aa90f486eb5d8be25252b2b5c7ee76ff63d9a19d99a88a125b9c4f388b418
TLSH
T16A418E52A7FD0618F4F31F80A9B9583A5A77BC119CA9C9AC01540D1D16F2D08D9B1FB7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/ConfigCI/ConfigCI.psd1

SHA256 3e4c475829b612c1c7267d3fbefb95a7c58ba82c3ca0d7122ee5accffd393d55
MD5 f9cb2d834d90ca658554a58310c34c38
SHA1 2bcaca80f47442707ea03bb41b5ec97211f9c37e
SHA512 de9463cc36af57cf3bd1c7d2e55acea44456ef55018f12b9fc958b95f21a6586dbeb69d8125952a9847a960fbedc795b971535f4f20db90537adbed801a19425
TLSH
T1AB01044AD408EE365C7D1A61E100C586FAEE73BF7616857F327892CC0B36957D3E0154
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/ConfigDefender/ConfigDefender.psd1

SHA256 1f1e965d314f15c4cb86eabdabcc8a1ebb375adfa7c50bcbc1fe54fd4df7e19d
MD5 8a35d78e32bfbf8d8145147c00d72118
SHA1 77bc4db17499e7cb099c420bda0a581b56d8007e
SHA512 6e303383495bb4dbd35ab660a70a73534f5eea213458e2922b78a52b5884ae001b551294273c89e0a05cb652f5fd92a85b42f76eb677b9c80fb94e484da88578
SSDEEP 384:NSBOY9YNa6zHblxuGLrNBC6djEa4U0SXuQ7XfuJ0h84kvNSL2OkQ17P4AuL3TD:fY8aiH/rNBCAjDfje8XmWhc1S317zy
TLSH
T185627CF34B52308D08BBD521E42C9B8BBC20575309E3156B766CB8018BB1B656BD78E7
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpBehavioralNetworkBlockingRules.cdxml

SHA256 e12ca21ce4d7da0dd287a3d2029532ead7a831761585a36bf9cd8c86c7854d54
MD5 eb7e9d6f8452fe64d33a841f39cae26e
SHA1 a4463256118f76960960d1fe8706a57d5faca0d9
SHA512 7162c721d49b8b066b061c4e60340320de8b44038708ed9a3e3fcc418415cbf001c57fe1f053e6ae1a039a03984e1dd44b3ae924854caf01cc68da8d2d5b50da
SSDEEP 384:PTvYd0NVCNa63DNxmqORkhdB9NFkaCJ+bi1QMzzvkHN+KaJqHcIPGvz/UIlq0yC:O0Qaur3dB9NFjcQmQMzzvkHN+zgvPGvB
TLSH
T1FB72157E0F903C3D14228534F11992996B3C4E02F8ED29F5758C780FBF65A2DA69359E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpComputerStatus.cdxml

SHA256 7678a0997d555b4d6e9e7ddd92095ed275c0eab8af8a347bacac31926bfb7d33
MD5 4022d87e26db62fb52db60553c284354
SHA1 23f2e984a3a5ac62345bf119c30de90ad82327a4
SHA512 8a8c8806ef54b9ba6cb0fb6835bba1318352fde9e70dcf83d902cd50ed2ca3278f70f9c96570e16a15e87f522494ddc840fa38dbd9bd88feacb5f60ba22fcf29
SSDEEP 384:uu0NVCNa63DNxmqORkhdB9pkakMW+tH+JV/QMzl4IhkHN+KaJqHckuIz/FKNRX:P0Qaur3dB9pj4Rj/QMzJhkHN+zg/uIzc
TLSH
T15662287E0F103C7D0456C434F52D965A2B3C4E06FAED2AFA7988380FBE65A2D25864CD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpPreference.cdxml

SHA256 bd65ce8769e3b4d499b66fe96b264d60b644333a70af2b6c5d720ffe35ecdd58
MD5 3b33d31d7301204b5bed79b9ac395ffd
SHA1 fbe704c4ec8a209801d73414993fe9ad8068d052
SHA512 52baeca24ace10645a6032a760e7dc7475fbd4aa39ce96b2a1aff5a12b555dcf8a339856c59aae8b7865666a36f161a81ae51ac65962ac93f9ef55144e3d7eac
SSDEEP 768:5oXNS+K2OBbqoVYeUDoj8z0Qaur3dB9rj/k6mvGpa+f/qQJBCNCECQ:5aNS+KDbqeYeUDzTNfrj/g+fy2DQ
TLSH
T1C9E3205963C52BD942B119A86562E8B4CEBE07D3706D004474CF3E0B9F3BEA8B573B19
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpRollback.cdxml

SHA256 8c1ce1f3148e988bbd0c6cc46677bf1f3f284cf41f8d86de97b24f1ade789e25
MD5 48db765aefeba7a232eedcfea70f2efa
SHA1 30e9d323ee5f1f4c0a1d8eb628d23fa0f5d1a708
SHA512 029d2b84eb4c01d2e8b259f52d1a3ce6f3b7c32f1411b4297e47b646851492b0701497d3c24b4768ada3f6b2652475c82851aec357b3f09e0c9337afc53cbe34
SSDEEP 384:iSD3Dnx0pZRNALwbl6aP5BBzP+ablc40webq3r27Kw5yR7GlUiVllJrkL3:i001N4IDhBBz9bS4fecr27KwpU+rkL3
TLSH
T1A172E4AE0F412C3E156A9134F06D96699B7C4E82F9AC55F9708C381FBF3662C62934CD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpScan.cdxml

SHA256 bba4212caa8fe1c29be91495e7f0560349e43d70218c4b897ae7e33f7ffcf13b
MD5 7615d24a78d380d3dfe6d295056a2f9c
SHA1 1013e6052540a9ccce0f73b620ccac772814b2cb
SHA512 532a633a4c4b23f09faee6fb107524a8c2eca54c8fd7353f58632a918cedf437f0cf0c1bc029e840cdd37d822317c1faf4969d3cba976c1037b3ad9308c1da6a
SSDEEP 384:7DORD5N4c0NVCNa63DNxmqORkhdB96kaRoWa2QMzTkHN+KaJqHckApz/+Sw4TwF:K0Qaur3dB96jRva2QMzTkHN+zg/Apz/+
TLSH
T1DF72F56E0F903C7D08228534F5699195AB3C4E42F4AD29F8748C3C0FBF65A2E6A9359D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpSignature.cdxml

SHA256 6948c1a608fbe0d4fc9cbf516bc0688f1bec8359b84c402e364b029ab9ff790a
MD5 1eca6b8b9cea001a16a7b806164f6782
SHA1 c2079ae2e480c3469e1e05b4fb9ab07bbc77f983
SHA512 0dbb070ff5ae6f605a068bea1d0afdd81c8ae95cb1a6842bbd3509afbc4477ed2087eb1d8e6fb2312e2244237cc49a4f3438425e0439909c166c23aff1976889
SSDEEP 384:E6D5YR4E0pZRNALwbl6aP5BBzPs8mJ9VTShjpTM28Lfl18JsLMDW8r0mrtGQ+W7q:w01N4IDhBBzEtbVTSNpQ2Kb8NWStB+W+
TLSH
T15872E4AE0F922C3E05564534F82D86299B7C4E42FAAC14F9744C381FBF7262D66978CD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpThreat.cdxml

SHA256 596fabe343f11094d26ebe778f3f8259d8e9d172625412b40c535ee40054bcac
MD5 ac0f56a486935fc3536281aa257f6aeb
SHA1 7befd93027fdf5d5a6fdb90938b5de6099d1358a
SHA512 a1f0c8504f1a05e56208a11f807f490b561af1d31d41eae81cbfda54ddc23ab95a0e222acb9f92f8f6d96c911e9046cb42fc06cb0e8067bc29479e60b09d2a91
SSDEEP 384:T60pZRNALwbl6aP5BBzPZ8m4Xhw9VSdLYFFO8LlQj8JsLMDW8r0mrTGNCwEF:O01N4IDhBBzhtgKVSFAOUo8NWSTWCwk
TLSH
T10172066E0F522C3E05669538F41D962A9B7C1E02FAAD24FA714C741FBF7262D22930CD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpThreatCatalog.cdxml

SHA256 111f430bec14b8408a2ebf4d34634b48e3c134c18d2499e52f6a8f4827d89f19
MD5 cab09247592e4c2be0ca96c70b8f401a
SHA1 27d986eb427a1be618c4e2bd78adfe90b1ba6e13
SHA512 b5650d7623b17ea5e61fd9e9ab14733b533205e5f4558bac733dc90f15db4d75c9503628e37aba3486f6730767e8c80c4d780d5e4de7dc770e60bf4108d0442d
SSDEEP 384:R0NVCNa63DNxmqORkhdB96kagdTd+WcmfnQq7wGx2waM1JpNNvDNqzzYL5DOZ4:R0Qaur3dB96jMTcHGdwGpa+NbNqnY1q2
TLSH
T13272F5BF0F512C3D04A69530F42A855AAB3C5D41F9AE11F9B48C381FBF2462D22974DD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpThreatDetection.cdxml

SHA256 443d2d4c8d3698ff2bb7264a0b42cfb496523c42f50379fee237d3cb6fe9fc0b
MD5 e0ba545416d7c2c22b87b91cd73be0b8
SHA1 b4887230c5fbb9ab09b80ec4f3a427ec962b07c0
SHA512 6e29e4887c5485dd4cd5aa8b89584c10cafc1f78b35ea35dbd083156acc301e87cd83157ae9db0798fdb181f63cb9ffde9bcce77a34940c31352b062dbaed50c
SSDEEP 384:t0pZRNALwbl6aP5BBzPf8mtxwCuFPQMzc/BkHN+KaJqHcOCuFqr/pxZqEW:t01N4IDhBBz3tznqPQMzc/BkHN+zgQqH
TLSH
T18672076E0F503C7D05668575F02DA2AAAF3C1E02F8AC29F6755C380FBF6862D55834AD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefender/MSFT_MpWDOScan.cdxml

SHA256 7d16bb369cbe5a4fbfa355b791365638cb5e5fba9dc234906ad0b4e51d9d2de1
MD5 51d4f36107f2ce68cf31bb4240e1e4f4
SHA1 20a02f6f84e087429cd935bf7d2894ccbd96d16b
SHA512 a16f98d7f2ffd71e7328e8a2c1667846441ab2f3189ec5d73beeec85b6a96576930f0f18a9d6b3a6de172fb2f25999d47d18f843588adc6761899970f770379f
SSDEEP 384:L00NVCNa63DNxmqORkhdB9zkaRbkUmOSQMzvkHN+KaJqHcIY9Rsz/SG/:A0Qaur3dB9zjROOSQMzvkHN+zgv8mz/r
TLSH
T18572067E0F112C7E19628934F05CA6696B3C4E42F8ED25F934487C0FBE6962D1A838CD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefenderPerformance/ConfigDefenderPerformance.psd1

SHA256 224d8d4768e2d33e27dd26014e6334eb436e507768bdb2bfdf8777c4397a5564
MD5 cc3e661faf921f03e941cb36d0000db1
SHA1 107794f5bcfdd048c89fb44b7e3c725a10633fb8
SHA512 f4ed6aa8ee59dfdb0f5e5ab7ac13dbae2a8d614dc37a347530e646352d8f74de0fdae080faaeb69a1360fd072083771ccd0a0195d1674fed5ddcf8c5af71baed
SSDEEP 384:BY9YNa6zHblxuGLrNBC6dqEaX/Bfgfm4HvzmrrtX67hcCcivR9dBFxXk6c:BY8aiH/rNBCAqDPBfOm+buxXatcWBFxU
TLSH
T173625AF74E26300E1937E511D46D8A6EB9641A83ADD62A9BF94C3C128372B3163E34D9
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefenderPerformance/MSFT_MpPerformanceRecording.psm1

SHA256 b4d1e02d837079b6655f6b5c262015633e0be030509e0a9a0b1105911aeccffb
MD5 7f633eba4fe2d4e5cef301facacd4839
SHA1 2d88ff464050b47df90753a1ef7f61c11d2ab224
SHA512 62143edb7e75bcb44b44f8a43735372158e04d6203af9a99dece7ef8cd775c20543bcf21f3524f09be8988e00eeaa34d482439d687f4d639ca07c05645a6fc75
SSDEEP 1536:yP1YeVLqzm4vFo1BWMWuT7qCW+H/8kQYl9mrd3wG8OGPDKQxV1AcJRBF/AwgFXbW:yCehqzm4vFo1BWMWuT7qCW+H/8kQYl9r
TLSH
T1577319A1A70D127709B3A397EDD29449F73403A3A1FE04283AECD4815FB2946D3A6F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

File Signature issue

Digest

494b43981afdf7823caeefa168e45a3364ffadc7a695a6516941858a42bc52b3

Digest Algorithm

sha256

Digest Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 12, 2025

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:0b:8e:a6:48:5b:8d:78:c8:48:fe:00:00:00:00:0b:8e

Issuer

CN=Microsoft Windows PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 22, 2024 - Jul 4, 2025

Subject

CN=Microsoft Windows PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:6a:19:00:00:00:00:00:04

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:01:d1:45:59:98:10:cc:42:4f:00:01:00:00:02:01

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

HFkiller_full/ps/Modules/ConfigDefenderPerformance/MSFT_MpPerformanceRecording.wprp

SHA256 e796454fee4cf17efdc25db5feef00a5d7c1b335e6c4b4fe996e8ad7cab01bc8
MD5 990729ad92c1325c42b04bc975ecbd57
SHA1 1cdbe901753cce8d933df8d50507ce16a25aa428
SHA512 ea0bcd6122068da9412e5195c7aa3017c187790c790197ac5af129f3acf6c23780169c0165627e5c55cb3b99e6931cb18a42e61701c647ff07eaf6da2740daeb
SSDEEP 96:aAPEP3EPGEPJuDhDEMTRBTCq6IQEPvAwWSJNLKI+EPZMhkvyXHkJi2eEPZMUkvy/:aAcPUPpPJfMTRBTr6ILPvAwW6NRPZMh2
TLSH
T1A9A16930E2F9CB7558CF6D257B809CA19E3916F303344610F4DE4A18FF969890B7B2A6
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ConfigDefenderPerformance/MSFT_MpPerformanceReport.Format.ps1xml

SHA256 a9788910c89a15f380cc383bccc4bab980babac87dd181590e351cf49b7d4ad7
MD5 e54d0d2af21e7851db231a9dd6f552e5
SHA1 8eb17886ef39d030299c3f99a93d677f5c851472
SHA512 988477aaa922f613d27531c91a6109f5a5b8202a016690652a06d2c0e05fe0ee0845d3ecc1e7a41e47d38364804deb431e0610dfe77d3ee6a42cbf0eec18bb28
SSDEEP 1536:RBjnDWhwL/L8LSLxLnLULsLxLpLVL+NfjjgA+pd:DnDWh+Da4NLSqNlh+FjjSd
TLSH
T1DB935419A2F42FF406B64467B6E86849DF28021B587B11E4F6CC5B1B1FF1C60A97393B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Defender/Defender.psd1

SHA256 1b1971fcbdc0abc871748d7409c696bb509c4ede12b0c748af0af96e629961b7
MD5 e85c068f55ca6ca8083e7637f527ed83
SHA1 ca1d0b642224f9ed9a722b2834fac0063436249a
SHA512 277c22b26c3e7e99f0f4a4f810cddac0e14af29be88cec79489be084b75c4c31dbec3bb0cd7160ce6cbd42ab94e89a69c2ab1da7da91a2271b7c26e3e0877dd5
TLSH
T19B215C35100605D19A36C373A2014F0BF5616BB361AF4A47B6BC82440FF2E9282A3976
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpComputerStatus.cdxml

SHA256 250a58b9ec6c327e7d165cecbdbae0b1fdca203cd342dba12616527b47a44486
MD5 79ebb7cc5c780f2b81d4f1d2d69f0daa
SHA1 3109ee944bcc5374cbba6f653c319c3d660fd797
SHA512 c23f43c3f8e7540e1b3f4deeec05fc2914971b711ba4ef58b9a17a8919e8f9012a66b1d006f41dd7537afa49a65f7eda64e03202d76bf62fb5d9a95006c8118e
TLSH
T1F4F0E220A3C5C5C58836920D9296EC44EB456A8BE069A946F1DCAA070BA7C8AF01B75E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpPreference.cdxml

SHA256 8861d55dd84b45902d2fbd8f73fd663be669f589105ce656000b77496ece0de6
MD5 e0e22818510f3d81e07986946a52e3f9
SHA1 f823b80af37ff3866a4f17f1705db0b7c10c4ab1
SHA512 35d379c63b7c2766b352486a471d9b309c9cad5be305d1815cc816529a1ac33f16b0e2acdefd9759009717c646e482c658bf6532a8b17abf82f61f5330552b8a
SSDEEP 384:pnDhD9DkED5HrD8D5jWDpDhD6dD5DJDpDED2D5f/D5j6DnDTDRD5DfDhDCDgD5jd:63C2k
TLSH
T19D23CB5963C56BD542B119A86962A8B4CEBE43D3306D010474CF3E078F3BDE8B577B2A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpScan.cdxml

SHA256 a27630566684ee79af41ac68dc70bbdbffc968b2489aa16be0d0fa0e0eccf0c8
MD5 c87521435f8146ce6a47ffacef54b90b
SHA1 86f324c9cbef269790dedce7b8389e80cec84c8f
SHA512 91ec88cba0558bc6697bf42c419f43424c7f8be8654475a034c7dd70fbd7eefbf1e5be44ab15f54f92183d877be8d1beb3ea4d93abf1986012d590b5badd3b60
TLSH
T13231890877C5ABD249B256685A66D8B4DF6993D3302C1840B4CE3F034FB7C86BD23319
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpSignature.cdxml

SHA256 dbb84a0489a5dfeecb4e850412aabb72e725e5f89319d9e158a8baa9be6470da
MD5 d6b0835e8b70a2f6ea975d00d6363d6b
SHA1 2a4c7b9c0804a558db3139a451d4bf504e069871
SHA512 77170a52f52b028967b337d2bf7fd2aae59dbef8fdb892b5b4379e6d33feaa8e8c4154445d4ee7003bb1867e311a4319a647bba882fa26aab804aff827af9852
TLSH
T1F831CE0D76C5F9F284B6492CCD629860EF2443C3212D8540B9CE7F034F77848792B75A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpThreat.cdxml

SHA256 ae595236832a3884d2aa3f913454ac6ff4c735f55e819c7f391c94b653281f92
MD5 4d709e485b8a0875811cf41eb4ddbd65
SHA1 45bd478bf13d8e07d940d2143bfed8a80af843d5
SHA512 27856f3b41819edfd02306481f2610e0649d5c7aaa68363716c5162d63235728658be6857c8042b8d2899a154c5cf18c2c4bfd88093364da72c4267195645218
TLSH
T11821BD1127C599C589B2911DC296ECA5EE146793E17D5408B2CEBF070F3BC47B003326
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpThreatCatalog.cdxml

SHA256 106d459542c3ec7dd9b7e545d74a4a98f0ad74c7db6a1333cfcd9168e2a3c076
MD5 415cae81a5669444f9aaf59ca179d961
SHA1 0f475cb38d7e1df34c263748b0a136ca3d404c44
SHA512 8f1547681369862fed45868f76a11dc6afe5fabd17f2f66c3eb847e42d1d9b5feab20d02173d7f897ae7ff18f9161e1cf125a0684a2346e0ca8b15fed7e3e532
TLSH
T191119C0053C499C945B29518D2ABF8A5EE05ABD7A07C5109B2CE6B070F37C96B00336A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpThreatDetection.cdxml

SHA256 a19bf000eb950ddd8438c30562c0fa6f3c0848432f55a219ef3d79b302aa6cf1
MD5 0b506d9dc73a753f395b5e801d01e6de
SHA1 5fc1059b4f2ed0cf8fbd319c9c2c04becdd47292
SHA512 5b6314a24737a1463b4c942075defc30fd4e06cd8f58909be04abcb3548cac8e08cda250bda6022981313458f060f57e01bbb701d528573ac5a71146d821912a
TLSH
T11111C00163C499D945B69118D2A7E8A5EF147BC7E07C5105F6CEAB070F37C96B00732A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Defender/MSFT_MpWDOScan.cdxml

SHA256 80ddeca09c6c85cde406bd9352c24cb6ca58ab17062159713f0591c46fa7b9fd
MD5 733e9ba8959283127fd4d911ce0fdb3d
SHA1 c420645aa70a6dab7e2d597db5270d63f3945aa8
SHA512 d84862e8ef9c46f0f153dd0a359df9c09170075ca9991b048b2bac48ef78605bbbc6e727a7e47188356e4538a5cda0e3aa2fd6e0b10622006fe78eddcc888f6a
TLSH
T1CA0144112BC9D4E28C73E20C8299CD91EF207397406C5C04B5CDBF131F77086B903619
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DeliveryOptimization/DeliveryOptimization.psd1

SHA256 cc3046419955131e4afab564242e0977c99b2ab5633bb7cc4f788c3342ba3832
MD5 8ac4773f039436e3302489cd8a839391
SHA1 c6da0de61dd596dc3bfd7777bd35d0a7a0f1fef2
SHA512 8394b11886fd25b6e465d5ffb7f32bc31722c978bfd2da5a61dd4ca3a1ee388f68549f8e0a92c850a9c5a6fb0705ed87feccd6bcb603b5ec66b97f971ca5c7ad
TLSH
T1B72106A6DE090D3650371662A788DC09F7B87B3351065D2FB5BE421C9F3BA6183E750A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DeliveryOptimization/Microsoft.Windows.DeliveryOptimization.AdminCommands.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cdd08a7e15ab8f6c2095486d0cf2ce02478342f891c10dc40f10a716fdeefdc4
MD5 ac720856c96bfd78d94ee504f3be76f8
SHA1 ae167108478e9e047a5cc715ba6e3398359f32e9
SHA512 91e8156cab0ddd0a881db85213b49e07469645aad32e5722fbc2b7f7a6220ea1800e7259a878eb267d86907a292a1614362139733d409df73a4a2c3acf575468
SSDEEP 1536:FgQfzdlRPvDmLZy/yRByMfHKyYb0n8zTJ3:FRfzdlRPrcFRB9HKj0n83J3
TLSH
T19D531A1127FC8159E6FF0A36BCB505000733F907B236C76E19AD995E9F27B918A217A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

69466

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.Windows.DeliveryOptimization.AdminCommands.pdb

HFkiller_full/ps/Modules/DirectAccessClientComponents/DirectAccessClientComponents.psd1

SHA256 cd06b6bfd1faa5ee1324fd4ff103655232cfe030ce8cbabecb170906a722a319
MD5 c3cdf16d974ba5aae30a1f07116fbac8
SHA1 e5a5863a08125646d1aaef21a724fd122f000453
SHA512 d1b524fd30c13e50c08e5809476df84e69559d1d949e0e42e2e489d04bdd42082d9fe140e40741825730008dbcc706f40db5b96f9ebdb5ebe94c860eab04a6ca
TLSH
T17A219AAA8D282353743EE223E4CF484CE930475211984C3E75BD9F89073E812936DF68
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DirectAccessClientComponents/MSFT_DAClientExperienceConfiguration.cdxml

SHA256 3840e12f34d3781ef36d7acad8309de15bf484c0d03e39707d29d9979f1bf517
MD5 0f3e4fe8d6ea8f878723971636a1b495
SHA1 93f8991d4917d5b954c6ce51c2c1604dd60e5bbe
SHA512 2321a58af19b978450a138e3d14ff29e99accb891addca9d4987cf88ef25c7702335d804de2a841f40340c33a03ea95922488ff9b0a3162a0e79072094aacd52
SSDEEP 96:pYX9rvF0Xo+DQjviL5oXAcCQxZc3l2+MWF7A9IzGBAaBHIEWFP:3XzDo61vv42VNMOH9
TLSH
T19EF12661338A27D851A1112B65769875CD7C4BD3315C0485B0CF3E27BB3FDA1BA63B28
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DirectAccessClientComponents/MSFT_DAClientExperienceConfiguration.format.ps1xml

SHA256 fb096f9e59001b782cb9145dfb39bffd6950288322ba6789042b81da37e5d862
MD5 162897402143fdaa6f69a42d90ca87b6
SHA1 a9c6713936ccf36313640b6cbaadd153d2914b2f
SHA512 2751a1f1886753e62cadac8f421ef5a17c75f547b969ba73ff3459b219f6189a7e721f9f83eb15aeac9b8ba3dc209ea6d9157d534909369240eb64780818a16a
TLSH
T17E410C4EAAD02E952CF14529BAA9B630EE50130B8C790100F7AD0B0B3FF6CF5053363A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DirectAccessClientComponents/MSFT_DAClientExperienceConfiguration.types.ps1xml

SHA256 6158b7913517c7e3bc1076d5998521e1edbe1e73a04b1fb1edc4021978cb9c6c
MD5 f784a98fc8bf2c5bd40a73bb3f9d456c
SHA1 2172e6c9d6c88ec8e2b5ad2700a92fc561a522c2
SHA512 04e5e6581cfee5f12990111b06c4bff27ef66f3365e07d62a7e1a44cf2000e8924610ba574a156b044012c8e51af1c6d74f1727d72c60a95b3c06a4956b74bb6
TLSH
T18901FE51B7EC84A04574140BDB29EC19DA20526B403F6069B15D9A536B3C44547B3936
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DirectAccessClientComponents/MSFT_DASiteTableEntry.cdxml

SHA256 b0d80e25db7d980c1a768e12d4b1f9cf80666c66706af0fb0d7088a387c6d95a
MD5 33b121667cb48576a12a4d50241e9f28
SHA1 b1538c28a4f7300117adeacb51a227aef715c0b0
SHA512 6ff6f5aa1baf75973bf9882d1863582c3cee93b9f775a06b95a2c4de47675d491388285cd9140ca9351a125cc70252d45403d256ac6877158d444aa12ae5ebc1
SSDEEP 96:pYGVC1uT7nBj/p98/p5IuOj/nzUzYOj/n+S42LZ1tB9nwLZ1tBxPoxo/+6:dnBNlmxrBSrBKm/x
TLSH
T1F572422123C65BE581B65028B565A8B1ED3897E3717C0856B2CF3F076F3BCA1BA93315
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DirectAccessClientComponents/MSFT_DASiteTableEntry.format.ps1xml

SHA256 e9fc2f9a15ed1a4405013bed890c78f2f7da3876903928ddd7607bcdcc4f39c9
MD5 6c1330e667439c046659f9feb43b3bed
SHA1 d098ff2c8a6be0d7de28fa36fa62529e9bbbefb7
SHA512 574c8c05e29c9e459e982efcf79247d326ca8e28a894c1b8f6da6daf11e9a1011268461608eb926d61aa936e7645758b12ed32b524d9d0260bcb96f03cafb8a2
TLSH
T14D41DA4BA6D16F916CF4811ABAA8B660EE15634B88790010F3AD4B173FF2CB5057363A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DirectAccessClientComponents/MSFT_DASiteTableEntry.types.ps1xml

SHA256 3af43939f7a45eac8a1827fefae57a1165eeceacdd2acb93840e5b1d978af6ae
MD5 b13aee15705be3090906b3aed2b7632b
SHA1 7255a2e206559f09330df508fb78b34f72147b85
SHA512 f374c8a1b9baa3c79ea81b8f26d36ed3f963bd35909ae8f578a4e7d279380c2256a583299d6c4d9884fcaf68f24c74cf3971bf3f38d36cefea8c55e8cb7df614
TLSH
T1B5215E51B6FC859088F850039A39F856DD10126B407F91A9719C9B837F388849797C3A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Dism/Dism.Format.ps1xml

SHA256 0476e8c703ec695cc4cdba62d795a546db567ada3c916aefb7473937d1e6c256
MD5 22e53d0e44212affe536ad0c658953cc
SHA1 134ced7121d037fbf3d4869bc097dc6632e69cec
SHA512 02a469a373e714ca78b4b421cfde4ad3d99ceff9c79270128578500184a10c0a0077e0717ec15894fe6b834ac513ef73736e4e59ae6497549bd6c7d2afb6378e
SSDEEP 192:NUFk66HuuptuupNcaq7hMhuupZ8KCjxKG8x7lC48xxRx886D:NUF6f/fX2hMhfLGxKG8L88B
TLSH
T143B23D4EE6D46E942CF185697BA8A660EE04130F8C7A5054F2AD5B4B7FF2CF4057323A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Dism/Dism.Types.ps1xml

SHA256 677a0f1aebb2065343914d286f11598275a10b5cc5be58ca88c301989c6878c7
MD5 89ed2185a32e7a5563380c199a2d9f16
SHA1 54b0a6137e33ea36e0a7ca448f60839e3a450989
SHA512 f3065d2625f122def9ce77c237bbdd596b592c561856086bb508de0b1d8feedeaba6b21e1131c6a4bb1d05efa6bd5c382e4cd40ad1299f2370019344e5e070a0
SSDEEP 96:PFUx6hJeUxllKV2hceUxClKV+h3XxA6/pgxKVGKuxxQESuxOWmKux29QkSuxmWI2:g5Mhu+5DU0lblhE
TLSH
T1D4829200F2FCD9A105B4543B6D222A83EE01A65F4936407AF3ED07576F32DE864A7A73
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Dism/Dism.psd1

SHA256 9b15cd5fc34d841f401b2877d6e9f73f2746717097191d80c60c9e97d48366c5
MD5 61f135d85befc95d50628676ec63a40f
SHA1 3a8634afddbd50b5b1aa8f2495e8861079226f9f
SHA512 1e04f35b5dd0dd92b142bba79ee9c021d8680b8be3c908b41460839df7ad9f7c6d335bc04765a875356f6f860ae07d16a81f3235df66d4802965bda8dc049d97
TLSH
T1B4514C6496772619853B4D17B58BAE12C16C3B63A4124B43317D03849FFA30797C2EB8
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Dism/Dism.psm1

SHA256 433c55bd12119e0ed47c2be204064c08d45fe03a944cc8833ae06904ddfee248
MD5 69ecdb42202bc4bb38e6e290b2064ef6
SHA1 5674714555f69fa1af325abc55c221dd53302190
SHA512 fb3c78b7796a5795b51de891a49316ee366d2521578789ea26d51745b1fcffb6eb444f4c6784066142cee59cbf607567facbecfba4bd469091ca32b47ad2acd9
TLSH
T1672151B1DF966ACF853F1A1FB4F7489B092DB404AE20A890316747E856C7B548347CBD
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Dism/Microsoft.Dism.PowerShell.dll

SHA256 15066405e8a34d32025300d7cb173f9e22cd58d241cf323ee1bb451f9afb5d3c
MD5 c71f3b6f5b5ef5a2db09d493627a23f8
SHA1 87cca016a9a4cae676c5dd3d79fdbba1c0d2c0e5
SHA512 d888631d520867eca18b00a8b0b65b95954ff3c8d88d6aa5f0ecfd9750bb9ff87dc3fd4fcc5aee18751e40a45f7e1bad6af8d678ede3e611b20c5ff4595e2d8c
SSDEEP 3072:CY1Rvzr7FTI0ka3dw0fgpQmg16OSUgK2NcVmEDRV7AVmv8LBN4u8w3+l:57pTI0kSdw0fgLsSiakRVC
TLSH
T173D33A106B78876FDAEF4770F0B135298374BB437A99DB69DA81D0EE6863BC091411E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.Dism.PowerShell.pdb

HFkiller_full/ps/Modules/Dism/zh-HANS/Microsoft.Dism.Powershell.Resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d2b49b5de260ac47d3df908529dc214a707e9e7ee9ece3b11578fa5b10416c00
MD5 08160abc29db8523f3fc7659ddabdf46
SHA1 74dd8021fc1abfa691f7f1368828229185f4de29
SHA512 7a1f7bb404cae23ac8431e6e02e606441827cdecf6083b3deb461da0e3d6a666941ea6e08761fc6284e824c9e44e3525335a317647c2e224d03a17e4404361b7
SSDEEP 96:wZ/EXi8jtGTyG9lpTiOE85l53kpoPOZix+xr5HrwHrbatsbPK6+mD9IZZmjrL8KM:A/EOTPRiOE85gr58R9+0IG2O8EWhmW
TLSH
T15BF1844267F41959F5F34FB06F7A8129B83AFC339F21C2AE5210201E0875959CD68B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/DnsClient/DnsClient.psd1

SHA256 0b591b6d51bebd285f2f5188550d6401758278c90f72038b59c366f8a1a9f55e
MD5 5a3a0b6b241af44599d9069b313b4904
SHA1 07eef28c7a4ab46fd1e5b2afdaa580b59115f1bf
SHA512 cc73bbe4fe8883839c57596572c8cd6da0ad0602e9c727df7e3a94535e37e1b70dee85890c30ef4043acf5c0c9a88464c35343ff5d98c9adec2db762b5307017
TLSH
T102310096FF0A7CB6003A7F2AD040D848F610ABBB1D1E890EB97E858C3F729434389158
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DnsClient/DnsClientPSProvider.Format.ps1xml

SHA256 4a5c4aaf62f04c58c7d035179c8e768dee9a972b005fb51dfb17bad28918c151
MD5 246019ebaebb9ad8613fe29d73079060
SHA1 614aabba427c357e5398f4ae42a0554cdd945ef7
SHA512 dc36429d4dc1d12a0029393a1c5b2d4859a9180731ea667e06dec2599b76da13f5aa669f9cc701647a8249c974d7a41cb167ed3d8dda54fb1c556e3d2a0e4995
SSDEEP 96:oEKBDnKHxfp34Tf2GVAWBjKCyFuXNuyakCpCX01p:oyHdwfxAWECy6OtCXu
TLSH
T1A582024FA7D03E9118B18519B6A872B4EE14520B4C3E2961F39C670B3FF6DA1453353B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/DnsClientPSProvider.Types.ps1xml

SHA256 4f04f1eadb52a7ebe493976a327d9cbad60c1926031e353f5631717b317ac971
MD5 16e70b992ff7e27dec798ff6eb3df49a
SHA1 cfa07462ffdcc439efc585505740b768d0a521e8
SHA512 f8180177012f714fd41c43758fb242171a20ab0adb36a2f249def5eb27d0484a03bdd038ec1b916f054cb977fdc093355e1167c9e856495cb87c3a472d84f64d
SSDEEP 96:oEKMDnKHxfp3NCSswUtdUOUIESsS1tdUOUb:oLHdpUtdUOUE1tdUOUb
TLSH
T18BA19905F7E89C9141F81146AA36E5C5DB31106B003EA198F2DDBB87AF7CC8887A3837
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/DnsCmdlets.Format.ps1xml

SHA256 842653872866b3422c194bee8007f0285d7cde7fdbdb065a81fa06035721ebfe
MD5 a60cae9afab5a49a067475f312531f92
SHA1 7ba668676b8d2474fb32d2bcfc35b93ca77f752f
SHA512 d32cdd45417baf4d52cebf3aa9e8f3ce302ff73b71932bfd3bb7d81cf9f37bc52726f6540e0b014ef2c4206f832ba096e9b92ed5f03b868db393fa6d3a8166fb
SSDEEP 96:79u9vGjuGj8kiak5fPfRLRLpLMABPs6BFseHewv4vPJNQvJgHZLVSHj3viJ+ytvQ:EaNJvJZoeJ2
TLSH
T16B53C50F93D439E61AB1864AB6EC6675DE21521B0C7E6960F39C470B2FF2C964233637
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/DnsCmdlets.Types.ps1xml

SHA256 1463a274001f867a273f29e1d1e4834203151160fd49c3266766de9886ca6489
MD5 cd66fb714928c39f96feb3bcc533ef6f
SHA1 67589bef323333ebac7c79f0dfa6879a2c7dc11f
SHA512 3a78e3dded1c75707d257ecebdb7e303cd9e770b286cdea04ccf5b65661f8592f2831ff4b0240d2b52f40a203c0182d2491d9e7397af79f97e1cc4ca98733080
SSDEEP 96:SgMZxPSTIRkwvw6MZx6AlJx8tv8t6MZxeDMEuYQxJNBbexKRT+q/xayytux9yYoY:uCOIFC+FDlmhQ
TLSH
T102A26504F2ECD8A105B4143BAD222A83FE22956F49794075F3ED076B6F31CE564A7A73
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/DnsConfig.Format.ps1xml

SHA256 528cb7f07e6b8ac80dc20fc4c68985c7c56cde6f85d0e9ffeea55f3296d044b7
MD5 e2e52345a9dce47dce5ae9be72b20179
SHA1 56a01584f8ae594474cbc7c02ef5c29aa32d4f97
SHA512 de75505c3eb8685023ae152127d0d4a15ea032b04ff00c22af8ddb53e0c1045cc0d2bafcf3785b6f5ef225f5f921ac9ab2beb03433caf5c47d6f5a36733cfbd1
SSDEEP 96:fnggeGlJpI6/Diwz7RZ3mrp7CRvRLGmrp7HDc4+3j1GlJGCd1e3jcCdh:/xj5I0DiwPf3Yp7CZZGYp7HyEWnwu
TLSH
T194929D0FA3D93DC55A72851A77B85629EE20111708AF35A4B39D87072FF1CA1C673E36
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/DnsConfig.Types.ps1xml

SHA256 e1c39934a3d412c8ed17172ee8181a12742d3000bd49f3dab6556cf83dc35a6c
MD5 44ed247c4c1c4847b3c6c6ec681167c8
SHA1 e79344eb99d12335768a3c64d304704b2dae060b
SHA512 61846dcda3928b24a46f86d268492981b261d6e6d3c65ac8bda0383d2cd1c627df7d84a24559eb851154b01b6a29a939f8b8ffbb200ba856ee1553d661a9d0f2
TLSH
T1B911D307B3ED909145F001227D165A8AEF2AD1AB05B942ACF1CE06BF6F30CD65163E7B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DnsClient/MSFT_DnsClient.cdxml

SHA256 281e5fc467866287f81d2e7322406896e2e2f4de1017662b9ff0beadb65242bf
MD5 d067724ead691540d1d49edf71570ae1
SHA1 b293d1f7d7e97742a86604fe122812617c799b1f
SHA512 9770cdc2cd452cb7039a5b5d06a25831e4d340c87080980afa4d69b0fa316dc8b97fd3e9853a447db1d98c4115002f356e765cb29018463e2086a90d139bdaf5
SSDEEP 48:c2YETs7dk7P7Ej6IIWcmG10Cj6WCs6KfNZzLmmGeLlUVdej:pYE0KjEeIIW7GSCeWCs6KldqmGeag
TLSH
T1D791591053C92FD986B26009A5B2F8B5DD788AD3623C4459B2CE2F0B5F3BC92B553727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/MSFT_DnsClientCache.cdxml

SHA256 2e7294b4056fa1028420aabd18e922e137e6a35e1ca41a9565d11f1dde4510bb
MD5 d1894f75c19adb2d7d3f4a556d1be0ae
SHA1 776994189ae2ae89c16c796c6255c3500d4c4563
SHA512 990f46b0b68ee9f9b859d6b74be0e077302a79a3120629fa39e5b39afcbc5d754e1e869a07a249d6bbcd5141e243c46982562b21a9c04f0bb2cb0236a416ba8d
SSDEEP 48:c2YEUn7N7HwlxZ9/dGXbS74mQGYLlUVdeRMjQXpI0i0:pYEs5HwlxZ9VGrAXnlqpR
TLSH
T1EF81151427C97EA946B26928D576F478ED684AE3523C1408F2DF2B0B5F37C923957323
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/MSFT_DnsClientGlobalSetting.cdxml

SHA256 a82f047f55d7cc3ec36c99c6921a9e84d910c4cbd0a3c26045d2573e276a713a
MD5 ef63f89614aadf9cd56e4f2344cfb14a
SHA1 3d706a47ac47e28258c11649cd00e9a14de9b3be
SHA512 34aca6a30f4a0396dfb804984e290741b23bbb12b9b47b3aa8fbf970b864a35d602b97e27b8ee49008812a6e815bca122882aeb6b88a252d98a57ff1ef490dfe
TLSH
T13B21651013C557D94272910CA182E8B6EE7997D3B11D488AB4CE2F070F3FCA6F593325
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DnsClient/MSFT_DnsClientServerAddress.cdxml

SHA256 c9c4d7b70a5eb077da900d4f26498467dad2590f19ddb4a17a8cb307bba8752d
MD5 6b9551e1764ade700256126951721445
SHA1 f556797793faedb1be691756439e95751f6391e8
SHA512 922bf3c6e19a4e7b7d7922bcc90b781c0c7af8037a19b5089463f633d5a01397e2e22e013d52405fdd9b6dca5f339811a1e44e06f82a154a2f643e6322a639af
TLSH
T18971891013C53ED845B26119A5B2F4B1DE7856E3627C405AF3CE6B0B1F7BC627A93322
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DnsClient/PS_DnsClientNRPTGlobal_v1.0.0.cdxml

SHA256 89ef0d018376588c68a9fad3afa3fd78ea514ec621a6ffd1aed84ef43094a7f0
MD5 84eb2b2d00ba471fe63a8d20a2391a67
SHA1 2dcb742d2aecc7e1c3f4fa86b1cc05f01359ceae
SHA512 8ad56ebef5eaca4df336d096ba7993847cd7a53024eed3498f670152a77ae05a9b0c6079edc1211638328090ebea1ed80764406a32ef856d93aabdb1451f466d
SSDEEP 96:mYE9sSowDZwDNKIjsswD53owDMwD59HwD5xOwD2DNKIjx:uD2DhwD535D1D59QD5xrD2Dhx
TLSH
T1F3B1311933C5BBD048B251686921E8B0DEA813D3707C4940B5CE3E079F3BEA9B97371A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/PS_DnsClientNRPTRule_v1.0.0.cdxml

SHA256 ad8ab81921e50fa931100574c9e04ce34aa5c10cbc26f520114216d7d371217f
MD5 1b613bd9b9de850935645ff40eaa72b4
SHA1 7c5ae339616135e7af23ef1852e7ca631c50a2bb
SHA512 d4482bac81cee3d25ab936fb12ed72eed745311891359b0ad71a783ce29b2bc1db8302de96613f43161843f04b699c07beb1bb17a24130a187fcc570fdb1e8e9
SSDEEP 384:SQgUpg6gVQqD9Oy6z9DGODRD2DmmDxD2D2DtDGBDBQgbOy5mR6gbdSDnQwD2DNDI:X4+
TLSH
T1D282F01973C56BE045B111287865A4B0DE7843E372AC0940B5CF3E17AF3BEA5B9B371A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/DnsClient/PS_DnsClientNrptPolicy_v1.0.0.cdxml

SHA256 8497ebc5d6a30c5b6b30e95a150e8ec180fb16352dbd58e779ec94ce3e08ad86
MD5 97050b02f66d2d77baba41c7873a2980
SHA1 14674c7c4a56a6628c8cef02b5ccefb0c062162a
SHA512 b3f5e281de8bd582d08108401f1b44bed1be13c0caa085f5c06212582f7310c2195e7d33e9c5f2d33fc82fa38b4ee6f9de06cd04eea4afdc58c9a59f7c115184
TLSH
T15731592173C5AAD148B2A11C6155D8A0ED7C23C3706C4984B4CE3E076F3BDE6FA63719
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/DnsClient/dnslookup.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e98d44843d37d1a917f327b91925af1563db261c5ead448a8efa5f1f22b62c7f
MD5 ff7b1648e7944b6ae790393ae23fd1e1
SHA1 b001170964a737665e41c0e18837fc07d030a6ed
SHA512 ade408883ca90b4e7b57a811077eba0bbfc139218cba8041651e47160dec3a0fd5b06351750d5fee5965c4862a17147fcf221fb225e3a4f6626d42e5f8a4d9cf
SSDEEP 768:cEelfsEv14Ybu72N5WLMNdIHvwMij4LssqxHHnlr8MF4P+HNFyA41KDdj:Lelfs214Yb2kWIaPPij8gp2K9
TLSH
T151036D4853DCF9BEDB8ECB7F7812431A12359D1BA80E691ADF4CB4C93D2238446569D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

44170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dnslookup.pdb

HFkiller_full/ps/Modules/EventTracingManagement/EventTracingManagement.Types.ps1xml

SHA256 b98312b115628733df49feb692e9921943f591527381f8e37d1c42ae5e7ab7a8
MD5 34d06a085f91fbeb0eb7c681b94ca75c
SHA1 e5dc7a81c874f1bc343e3deb5de78328cf978848
SHA512 843ccbf016aae677095e54f6bde654009ae9d338115d5374e5cbe93df334a9ea631009dea3450a93d8ac5d1553352c554a177a134ece3011425333ba8a1e039a
SSDEEP 192:5jartUKe25d3RNrxIpP+I0LjLCkQsmdwIYpNVNfCA0SWpKt2w5d3RNrxIpP+I0LA:YPPRSAkYRSAi
TLSH
T1E7F13B60D9F95850D07091016B3AF81EEA19325B04FEDAC5F24D5B9AAF784808DB793E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/EventTracingManagement/EventTracingManagement.psd1

SHA256 0e8cf264eca3061a0c6e4f9b923f9b02637c4ac6c36fc8a28cd602e4822dc484
MD5 0b119994f7b711736346ee5ff63de2a9
SHA1 7bb99c8c511ff1e2e6045c7f599934e8358e2536
SHA512 1d0c8860fcf94f9778c84f9e324b238751f405896ecee8e9bc3911811389dc8e48fae9ab507d179bf5b5141e5a65a1eaa5cf46bda7c593264fe64ef95e868856
TLSH
T1C531082A859F04A6563DF783A3145D29EBE48FE3122583C77ABE34280FF39215AD41B4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/EventTracingManagement/EventTracingManagement.psm1

SHA256 f02fc225831c34c78f39c9e2f716b3a37cdc079c5c33ea08525970842abff291
MD5 d329a4e3266d58f7508dd32b765d50a7
SHA1 7b5dce66449fe09d60cc179cbe06771b03b6bfcc
SHA512 8b9b16b35f93425517709395a46a16875e95ae0b956104e56a1251374a03fe11c36572adf2e9bb64f1afa12ede2b8983de4f99f3494d8c3329f5c941fcb76678
SSDEEP 96:cqy0yikGvssZKUkKrrry1DuKKxTRFSigSiXfq7XNN:WJikcs+LkKlKKx9FEbyLNN
TLSH
T1DEC17E7C26574975047AA3B46D97802DEB3950ABB46C4601BAFD50903F7AC24EB7CF8C
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/EventTracingManagement/MSFT_AutologgerConfig_v1.0.cdxml

SHA256 f41d85870b1f7f97640df0b76935546f93913dbf61de9834f304b36b9a6f258e
MD5 f2f530ca3dca14ca4c4ddbfd3121ead0
SHA1 542ff3ff5076931aee42096e5426df2295d1fa5d
SHA512 02f7ec45961f7cb8f299bfc9cb557f1486c1c949fe917851ea5fa61ec7305052d7b4703f9df745e87e7f743d61e0d056d9501aff01921a53974de83de5ae8502
SSDEEP 96:mYECT8bY4lV9fPfvm5A2EKZ7obpEPwxkpSb4lV9fP+fvmlebCA0OpYp2EKholThR:1I6iTkM6leCAvpaFhR
TLSH
T12402281123CA1BE942B01118A566A4BADD789BE3716C4441B1DF3F079F3FCA1B6A3722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/EventTracingManagement/MSFT_AutologgerConfig_v1.0.format.ps1xml

SHA256 6ee0cbfda1850f8304692529b88037c1530b3a805eef3aff1c2dbbfc64cb730b
MD5 af00233bf19d5eb561be3fdafdc72f89
SHA1 afe9aa54fabe322b8a105919dc6177acc3a388c1
SHA512 1de21718196ab33e10c27ae96398d47d85e99e30b989e8721abaeb5eb7d436d2a881b5379bd18829e2683bd11cc0b8bd18421d1d1a3bbd13624f95c9233573c3
SSDEEP 24:JdQeCPYaT9QMhEqwi34H4egNJPYMRVgMpEygq3wpU:3QlAK9QM6qF9ASVgMiyB
TLSH
T104C12E0FA7D43AD219B28555BAE86639DE11521B4C3E3960F79C430B2FF2D594233A3B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/EventTracingManagement/MSFT_EtwTraceProvider_v1.0.cdxml

SHA256 c1b442eaa1ca0d9889fd72e0a23ea869237203858db00686ffba7000317c6e69
MD5 ade49af9a330a660ead56e923d9f2216
SHA1 2de1a8053abf6f4bc201af569c0c6b820fbed215
SHA512 e5bfb99971e45a81bf2ba722750751e013d4a0f07e0118e7273327397ad2172ff5ae1e35a5a0b464e40ae87043159c349683edbf979e2a1f7ada3b967cfbb945
SSDEEP 96:mYECwu0wxm10tDApVDnZumlSbVw/W8jglrVw/W8jx:2untDApVDnbCO6XOx
TLSH
T104C1E12123CA5BD442B150286662F871DE7987D3717D4844B2CE3E078F3BDE1B9A3726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/EventTracingManagement/MSFT_EtwTraceProvider_v1.0.format.ps1xml

SHA256 da4b0c55d3e24ae419945d1d6ba3c185aa09985a0d34493a09cca13acf655636
MD5 a86582bcb8f69eb983e9fdc9efbc0ccf
SHA1 77e8a5d6bf742c8979ddcc0a1453756dc44e3108
SHA512 31656de2527106b8cffdf64eb38fb344c5cd9270e6e6738cd1b4f60f432b0ec7937c5c87d25f7181169077515c7ea8b6bc65e3f89f4bffabae56fb8e6f5e833d
TLSH
T12271C60B93D43AD159B6C41ABBE8A629DD21611B0C3F6A60F3AC471B2FF2C654137937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/EventTracingManagement/MSFT_EtwTraceSession_v1.0.cdxml

SHA256 13333b64bcea4268c685b53ef0c53d9de5e3ed695cf7da3d997301b8ad93340f
MD5 c4d859b094bdce2e75046a5c7fe2c05c
SHA1 49f09b07cb1c784176100e2adac7b37ef1ed93be
SHA512 bca3eedcfc275083d492753c2e75ecfdb09deeb00e16cc6f1cd7dd3a6b58f04e1d1bc333da1f3e9beae8549713b2d3cc5316427c260cc50229f4c283fc53606c
SSDEEP 96:mYECUg7g5f2aEml4lFR9fopGLDcC5wR/wlMCA3FW72BpSbKEml4lFR9foxRTipC:GUF4WDcHyMCAgCMsUF4xhiY
TLSH
T193E15C1523CA1BE542B161186566A8BADD7D87E3321C4441B1CF3F079F3FCA1BAA3721
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/EventTracingManagement/MSFT_EtwTraceSession_v1.0.format.ps1xml

SHA256 342e409e3dba8fc0feec43001005bd222565246b5f16dd670860679118ca7909
MD5 3762ba1ad7ff3e9db6bc78d1fbc32cfe
SHA1 4703f27540d2357ef8289a560d18c2d296f3cf4c
SHA512 e46664a0aa02114e501237be59a7afc727474e654cf0feeda63b670cb71e1166320882fb4812bd8093650a06a9025c6e5aa834e892d26c30a4822658f16b4d73
TLSH
T19871940F97C03AD219B28555BAE86639DE15621B0C3E7960F79C431B2FF2D594133A3B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/ISE/ise.psd1

SHA256 97f943bf1b563ebd1cfb646ef99f90617ec7a12a91712f26b4255f1db6f5f810
MD5 6204196b5f377d4770b495c2cd287126
SHA1 fb99d128747182457a9ae87df15a5dffbed82be4
SHA512 c409206679fb701d3185823b993f99e01d1f57c9dd98ea8a1a29e2c86cfe7be2dd5229f079cc59264bf2aca693933f7812b68133e2acba0463d7724fd5eea332
TLSH
T113F0C0EF853C2143AE06B59FD050C409F37C6FA3A319CE8AD3EE879402C6958C3960A4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/ISE/ise.psm1

SHA256 4f8c9a82730090babbdd39c009ac3043072a16a788a70356622c2fc98603a6b9
MD5 0cc58ed701d92783cba93de41f0f5147
SHA1 da8001f3cefdf302679044f6cdfb33f6976cb0e4
SHA512 c59384c540e0e7c311731ae89ebd47b3fb50d5107f82b6e849f8d5426e633f6647b7b6b20cfdd1262e38ee5cdb20dd1a919991582f35cd595d070ed6775dc2a9
SSDEEP 96:jXCdMnid8ETECfQ0QBdbW4v/85j6YRa8R2B:uG/EOrdK4vkhvO
TLSH
T13BA12275B502826241B7D7B9CD96491CEF3A023B73784900BAEC89829F76952D61FFCC
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/International/International.psd1

SHA256 642f1b22d556ea62e524850a4880bc749f7b9defaeed7b2aeb14c5f92dcbffd1
MD5 73da5f2a379ff4da4921d852fbbd1091
SHA1 a6ff5b44104ac6237a5f1f6e9cfee403fc1873c0
SHA512 78d630ab490ea8a0d20f06a5c8d750961258c43681aae67a7879f050d8f808e6953823a8af7ae8eb49dc893aa686be257b6d2937a82136a138cba7c44a894ac1
TLSH
T1BC112755F4688EB6F3EDAF49F5438C0D627C1ADB54025F44EBDBEE44C2838A46712144
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Kds/Kds.psd1

SHA256 1a27d17fe54cde77c17f4005363e8f740d722e0dfc390457440882a38e2d2213
MD5 9707cd15bb658a280e874c73b65fa249
SHA1 697a2cc47fc132ea9a9bce5d9724cff0e0061677
SHA512 d7e73e0c46d11bcbed9949f96a532ff37696e6e1d35f27991357d69c97ab2f174558ebba857d8515301b61a7fe0cd6805772c6ae23351a8c92c857d87db2b00e
TLSH
T14EF00E8DE08CB8339E442657C2A0C854B1BC3BC7801E8E1DE47DBF08020FD00D343168
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MMAgent/MMAgent.psd1

SHA256 7874ced7a61c92d2b642b8f08d02ef02e08b995a062eeed54343d2ac0d8d3478
MD5 2b4481b80de10d8ac32e362f85e84f95
SHA1 26337880cc170c2d3e9ee661d7d3d859071f46c5
SHA512 f12cabcd35c390e7e7570ef1c359bdbd9462ca95984b3a29916af401e5858d940ae311bbcc8596a64d8f7b310762ea2c7fd5e9d9f6420a6f7afca7802a8fc3b4
TLSH
T1A801995A1909011EEB7BC663F810C92DF7B49FA3D5288934B26D83080F27D27C3C489C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MMAgent/ps_mmagent_v1.0.cdxml

SHA256 0b0192e30756cfa0e813d5f345898f19679bf381ea333b42ff3490cc803f9d81
MD5 dc540f9d7084a93363aa74f82c80bc9e
SHA1 9b3ef3d73d7215adde0c512f828603fd8780260c
SHA512 86567702a07d6cd6eb7a91d2a3c95ba3f2fb45d2930de5ed04fdbcf8774e55e86f0c3515af47b3b4a652296a6c54b58ca507f43caeb037daacbee2c3fd5f3a12
SSDEEP 96:mYkCMvxDuD3FDnsBDvs3ABNs53s3ZSBNs0KkjsuABL5Tx:KhDCDnqDgtBy5Tx
TLSH
T118E1032173C61BE445B1102975A5E8B0DD7842D372AC0984B1DE3F079F3BDA6BAB3B16
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Archive/Microsoft.PowerShell.Archive.psd1

SHA256 ccb90df576aa0315662ff9279f3b09c23195a3d997ebd701e122419598060a7b
MD5 f30c3c71163320ebd64ae1218fc467cc
SHA1 1b088ffb5fd882f2aa1cd5b740381a18d0e05648
SHA512 eb866b7760ed064d05771d39c300c04d7eb436c2e4e316437cbe50f03b11b03bcfe0f0116327be3d8d226b8f14474396fc45592156992fef8e0d814503e4772f
TLSH
T123F05C1DA6088567FDB532EBEB40C468B3FE8BC7AC2AC5DA125C5384211B6A5D3461D0
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Archive/Microsoft.PowerShell.Archive.psm1

SHA256 44e8d903bc6e6dff25a6ea8f03540bf1ad8a0cd333604c17949c44cf4715f884
MD5 87c1bca57167d446370e3a2170410f8c
SHA1 54011fbaefffa08dc2519ef69d2857ea1fff86be
SHA512 62bfde59f67652deec9ac4f5e3aa071bd1ca296e0b506258aec134153411bf42d21b952f7491f08e41876fd3e18328dedb944fda5d1a34e1bded8738d46685c3
SSDEEP 768:kBFK8V1yDC5rYJik/3/JNjb61spThgv0g8F0Dur9xrGgzRV4Q+8W5en6LDK5vNWZ:koOOHTF74Qg5oRw
TLSH
T1CAB3694367EA1508F7F77F48AB7A45350B67BC55A939C21C019D648E0BFBE0488A1BB3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Archive/zh-CN/ArchiveResources.psd1

SHA256 eba1f359709e6cc6e1e9751005e664fbbd1579790eca7a45f7dfe9736dcd1923
MD5 e52eb1af0dca76af5f5c249e31a8fc66
SHA1 af11a7a5ee8f230d6a9761a342dd94857b03217a
SHA512 14cbc279eb79566003d78a51a6c9241b200ff5c2e0dead9784b45e4aa90552245ce3b1bdffef0bc0d6ecb26445c9f8fabd0eb6939cbc468af811a8f9a8f31e6e
TLSH
T19051CC8357EE1398F6F3AB209BB5A4268BF3BD016D2D860D109D458C14B4F11A1B6BF3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Diagnostics/Microsoft.PowerShell.Diagnostics.psd1

SHA256 2a7f36e2a72b3002a28e85223735ee026d3c30d53d7ce1ca9f25b140015b4ac4
MD5 eec1c001d5b76c884696612fadd5e9cd
SHA1 2920cd262f37b2904d69f65985ead661078a770d
SHA512 368ffe4d4e0bf3cc10b83b89c64f6179ec36dc1b88b4c64955a553b8b025034cfe63c506a02915baeab92c835e5b50f7d824fc8a1c35f763307865f2929821f8
TLSH
T12501F486F5085663FD85655BF2C4CC45B3B94BD75D258F5D95CC4FC40186DA0E30A260
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Host/Microsoft.PowerShell.Host.psd1

SHA256 f3822238ab155b84d738fe2164bb716fcf8b309d15543796eecfc67aa78e2065
MD5 f6aea8bc51bd45f79f94625bbdda82bc
SHA1 a8b1cc21649ba680ec8c52f75390f230c7c3967e
SHA512 7adf60d01e710a29f084ff2321abab1b1633bb6bce51a1eb91e4f1932ad5e200bf593aca09562c0a7516601431f95f1fa554b3f60dd7c204ed2b9d25c02fd7ac
TLSH
T105F09719AE0C90B3A99426DBE381C414B3BE8F934809CE8CB4DD1388014A6E8C384048
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/LocalAccounts.format.ps1xml

SHA256 0b5b8eecd3e4d9b12ab98fd98dd9551d27dd01fdadf5f118f1ef52834d483281
MD5 7c5d2125dc6ff83578160e2411f3e50c
SHA1 d889cc3c474624572024c4be39ad25acdb893551
SHA512 00064a1bb36a7b3cb17df8a385e055ea2d8e2d4cef7e04a7ce454039c08359b98ea6e00571b347e723d2e7844a047e5bae16e61037b86aa9b747fb4322a89c5d
TLSH
T120812C4B53D436C20577C84A96AC556ACE24A11B1C6F7AB1FBEC870B1FB0D068133936
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.PowerShell.LocalAccounts.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b7f1800cbd654c70aebd51c0a2141e34a39060ff9f950ea461bc2a09b680c2cc
MD5 1692f19a8f8535594e3b09fabe0203e1
SHA1 7888b3636f6c09794ef53398f7900defab10b6b1
SHA512 d632ee6e16ddae0f86c1d4ad3325c0cbd2505bd2d164f4b7ff4d258b78ae6a6e072d97433a723705ca0aff67ec5d20f622492b44e8e296f968647a7360d8bd16
SSDEEP 768:3sRNYAo5cdHwXnmBFPh5+wpMv4vN6IMjRkk1kjQQVhE2ipGtG4zTdJ5i2g21mtZh:3mYOSnmBFZh+4v+YZAo5i2gHQR4p
TLSH
T1D2936C64576C8B6FF2EF033AA0B1161193F0D64B365AEB1E0F90E99A3452BC54B20773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

95922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.PowerShell.LocalAccounts.pdb

HFkiller_full/ps/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.PowerShell.LocalAccounts.psd1

SHA256 7aafa9d1c721c7734297fb568c2a4682db3ad95e76f9b7e07202688362d6ae78
MD5 92dc63dc47047c9bec1f88a6d32f82e0
SHA1 ffc4da8b0a0e62c69e4a77e00133790c2adfc39e
SHA512 05dcab7866b3fd89daa5fc44005daed007b953721e258276f54e6072dfdbbe5dd5a7f013bfcc6761df061bf9b0ca6b86aa04ed055aafe0b5e02042bec6d56ce7
TLSH
T1691157B7841B553395AD900321426C58A2A54BFFC9688F17F5B6C8851BEE94CF3D19F0
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/zh-HANS/Microsoft.PowerShell.LocalAccounts.Resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1c0e40d43ee81fc2fba1cebd99ec76fa6cb84a637c34745cb3609941c36fd49f
MD5 349ba8e1d8d7623fa7812b8858221810
SHA1 c673f3e84fc46ba058da5c509b85ba854a21424b
SHA512 e3ff2bb3101c3515eb0eaa33eee420a36ecc85bd7523c002b4952b92efb54324611299a517633964980d0de39abe42cb6bf8b0b3fa5f9748cdcb44ce033df086
SSDEEP 96:+hG5muc9vAcEC+wQW1JFuvBPi+VrTaZnrlTpfWp6W:+hG59c9vnFu9BTqWp6W
TLSH
T13BD12C0157F9415AF5FB4F386A3B1A71A83BBCA9EA20C52FA464020D1831A24DDE0B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/Microsoft.PowerShell.Management/Microsoft.PowerShell.Management.psd1

SHA256 458c9e04548d2cf9474711d7a628a5a71fed490ed84fd762a3e65a0e1c71cc69
MD5 491f86cb0e15c7bb969d5016d4db18d4
SHA1 d234eabe1ea14515cbf47d0f2f00e3a2bfbc336a
SHA512 2d192afc26882bed769c25bd5504ac865d4d4ede8a82e3b960143a61d546c559db4ba9f027619dcb9edd90a0ed867601c3e1d297a30436513d0a39e1dc1a55bb
TLSH
T17451CB27D5206E7444F982867791C808F15827FF8A324A1F7FF8D12D0FB666923E602B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataAdapter.ps1

SHA256 04f67ace87fce03e811a73d893b600f91aa1eca385fe96c38a1f69e6f69ac58d
MD5 69f6124df57a8ef2ea208e3fb357d5e6
SHA1 1ac378e2c6d166dd242d7e94ebd1b149684cdd19
SHA512 006b423ec673b8274857a70b2bcc860d8a4d141c46ac29e322a8db932c0ac7561bd348a3801258d856aec833633c23b182300e6cdc54b1e0f0aa807cf5e19920
SSDEEP 1536:3nFjI/lEAvZQgVBFgV5wZcn2qMRM00x4H0kRi7DxEikx8UkZd:VDd
TLSH
T1B7F36D426BEE1504F7F72B58AB7E59740B7B7D29693DC61C009D684D0BFBA008960BB3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtils.psd1

SHA256 0772d101921bb12f7d7a07f5fa795a04dacebb1bec33111f89b2d2f1740ea8c3
MD5 e7b7d304f901913db03ec8a2c66928f7
SHA1 0eca57a45b2002d645d9ab9413db90aeea49e5eb
SHA512 d6d73a910ecd622486b4f742bffe558458db217d0c802c493fd48dab02b27fb86852303a27131392aca67fa366088a0975e01f33f47f5596ae32237a4f4f7470
SSDEEP 48:9cw9b0HIfb2eVccuVXsWd9VOieYcxbYojfAW4x49HkVFgL5B2Q+zQHxLuIF5l+z9:9cGb0gLdhRfAR+KVFc5wv4xLuIF5gmQ5
TLSH
T15EB1594263FE4504F6F66E60BEB160760B37BD4AAD38D66D0685910D1EF8E94C9307A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtils.psm1

SHA256 9ea4bd3d8fb8f490e8099e0412f091e545af028e3c4caf179324b679124d1742
MD5 b8907f15b686a4806a68a01e29e1c529
SHA1 5090f22bb9c0b168c7f5e9e800784a05afccbc4f
SHA512 5d064df15eea9357af29e3b9b4d0b659c2d7396b1048aaf505eccdb4087144d8b820534832aedffe0b883dc7021ca9994fd4d0923e0fb355121b5aecf142bd21
SSDEEP 384:JuRi0DcnIF6Dr87gOvif0xYxMZjOSdhsElQFDEoC6DrAmKltIEex7n+Z1uMAKKsV:digOvif0OxMdOSdhH88QS
TLSH
T16A927F4267FB1144FBF36B48AABE98340B777D196A39C51D109C684E0FF7A448921BB3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtilsHelper.ps1

SHA256 0d905709ab1174f8e12a063f259a52dabe85caeb8018985f5411f1ce9c6c99c3
MD5 9bfe41ea0fe8c57286d256feca46012b
SHA1 a920d0706fcea648d28638e9198bcc368996b8fd
SHA512 3d1a024892d5609f4e62e3ac2532cdc2f329ebedb589bc3cf6995f5b1faa376e25a6f4743b9aa987e3bda9af927a29c4bdf8a69b689e869da176b22dbdced2c6
SSDEEP 384:L9lIYb/1AgQ/nrfibtuXk1CWsX5KN9vusSRHjZgsx0Byn/LwfxwXTKJzu7wLSdVn:L9lIqQuOEGM2gyQ6d7InPr83nJ
TLSH
T1CF336952ABEE1508F7F32B88AB7B58740B6B7C156939C61D119C644D0FFFA048821BB3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataV4Adapter.ps1

SHA256 707bc293d8eb5aeaa23cb6a3c513a63dee7759ccba1471e7a3058948c1c1b074
MD5 42051ae4347f7f87b05439def05da3bd
SHA1 4951d34ef048ed8c69c33623c39f5ad5dc6d1136
SHA512 06e6a449eb64c9bdcd8b0b5d34ec85c5dab2ac0ac8cebd3f54ba8591a3236532ba119480262c95fb67df1a473f539c598613c2a0eefb879e9bf50efa8c9bf325
SSDEEP 1536:VQZY4yPbyb/1DLfFDWhIHMH8LaLyhYL/GMB:6L/1whSAvn
TLSH
T10BB3531976829127037B0135D6C6D15CEA26A13F9D3B0C22BEDEDB846F3998CB116F39
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.ODataUtils/zh-CN/Microsoft.PowerShell.ODataUtilsStrings.psd1

SHA256 e12f685eeb522108a038b6f0ca5cff8cf2f5b73b4505bd0e5823fa817d68057b
MD5 51210658a8264237aeb952aaed65c302
SHA1 8cfb7d81956fb4585a118f538a6c10d31599d9ff
SHA512 475f4575cd5caa12aac23188a6f22f6ba05127299ec091a0fa9e10c344b195f0a4a5fac46a8479fa3f49050453ae3c8a699f2ad1bcc0795919ebc6c11a2c6b5c
SSDEEP 192:giy+k5n0l+1MMN32k1zjRuGBWO8b8ORfFHKFYHDu+/pum3pHSHpcBz:gis50l+my9zRqNBHfA8Bz
TLSH
T1C7E1CAC357FE5424F6F37B70EABA85964AFBBC255A19C65D0048068E1830E80EC767B3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Security/Microsoft.PowerShell.Security.psd1

SHA256 c1ab068f94e092fd4b7c8ae3e8fc9fa892e87c8f6f026cb9a2b4aed936df1418
MD5 7e4c2772050f1a123b8621c026704769
SHA1 52586db8073d87a657b2c7bd53eea9eabc0708e9
SHA512 38a81a19f465f19f91c28872683ceacc071ec4c60f651aa5c52db40039aa596f2578c63198297af34a13d69840a9e6156733c49348766192364c9536ea397cf9
TLSH
T18A01205EE1088CF7AE88169AF1D1E40C73BC77E74016CA6CE9CC07C8534E968C3886C5
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Utility/Microsoft.PowerShell.Utility.psd1

SHA256 386e37c07f97ee68bbafed61c4b975b1fe9d4375b7c3cb7fa0eb6a044e72ecc6
MD5 af60abe41c0048f980d24f9ad7e1ac0b
SHA1 ec27c9ba7b57a13fe9c25322895ebc6bcd3a9fc3
SHA512 d974296c67babe02600fac5295d034514bfe68d9f598e70a8e213ecdc68deb989f10b78238b936a98a27ccf8d3ada66f65a10ab3f21100dc7e39ffbb9d8057db
TLSH
T1B451BC21E2048E7F99D4D64FB6D0C44CF31927FBC1540D2FBAB4CAAC079ED24965939A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Microsoft.PowerShell.Utility/Microsoft.PowerShell.Utility.psm1

SHA256 f9232f3de3c94dd03caf40f54b22876c9d810c657c41e54ab2d10469b45f26b5
MD5 53aca5c1fcfae4b24407ab80041fb0d6
SHA1 db2614b196d5a9988862c38e42b75adcdce07eca
SHA512 1da1423a4b2b9f71ed768fe7a0d3905e98678915e438553e0bec889279bb6adaa7f2a7b28db6c52b60daf7c56815aacfe7ba57e85b3e815619606c5b7334d384
SSDEEP 384:Z4UfjJBWtlq3MNmxUrkUBA3dbQmZOT/jUru+7:iY63Nme4Uq3laD+7
TLSH
T187D275663B08566707F2537AAAA79000FB25407B2DFB0A0879CCD6849F73944C779FD9
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Microsoft.WSMan.Management/Microsoft.WSMan.Management.psd1

SHA256 96973a7f69c967fe665cde9ef7b82423f34ad5248f2fd35f88d25fcda3fb9035
MD5 651b3b06114705c88b92a8cd6a978526
SHA1 7d8e3d2f9b91e44a98b879e79cd55fb68c14a545
SHA512 34ddb13ec8d2730ed718052c9e6ad5682c415b213b688d58f5a82be2e2c717b47719d6ed3d1627f2c4de51b93ee51548c280cfa45a22a9c67558fd1b93cb1320
TLSH
T1E101B891D61D1CF3BDCA120BE280DC4AB3BD9FCAD5058E5D599C554A021FBB3C3C1A9A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcAdvancedHostSettingTask_v1.0.cdxml

SHA256 ef1d87489f53c6fac620fc4e1656931ac6b4050b2bba6ff03412417b5006ddc1
MD5 8ad3984071cd41f88be85478d9d3b927
SHA1 de487ad34ef752c5bd7128829fa06fc7a47bd723
SHA512 4325334fe608c0bf5c98b0b7c263ee7c2c9d1f66010c2b3f931a6fc60265ba73cd8981a90ee54cd86374a81b22a74df7f18e87bde027de13c8061677f1606ef8
TLSH
T193610E2533C56BD445B651286262E8B0CEB963D331681840B4CF3E078F3BCE9B6B3716
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcAdvancedSettingTask_v1.0.cdxml

SHA256 2d892e242e809f9f00a74788aae4238f444c89457a14938fb8aad4368c69d107
MD5 5d3b6b8efdb22ab05507f985f511ce0a
SHA1 993e810d767b08df2adabad13d04dc8c5673b345
SHA512 b47b83603aa15f3dc7b93ebc816b29da3231e65b4db0aa7e6e94a7516a57a85446b8a056c417637cc0ab50f5210659f03b3d23927093ce48d0a672a4563a969c
TLSH
T1C881ED2573C56BD445B555686162E8B0CEB923D331681840B4CF3E078F3BDE9B5B371A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcClusterDefaultTask_v1.0.cdxml

SHA256 3df4b2418ca164d47955513e8a3c3f15d8feac815b5f67b73530246477709814
MD5 4b71eea40417f1c92f70265e233aec8d
SHA1 957d834f0745ba0615ccbfe5bb14b30982502704
SHA512 7e54f9939ceb94c1e0585ee36b1a90a4162f61b50fcd89637794add1b53cea6b9a3847f37c85631e98f6e4cd99f30fb907b62d728136e5c6867d7bce072f7b0a
TLSH
T1BC31632137CAAAD149B6901C9265C8A0DE7862D3716D1C40B4CE3F075F3BC9AB963715
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcClusterTMMappingTask_v1.0.cdxml

SHA256 d66f1c4770afa3db635f84db8b4add3b9b6d020e7debe749a8320acdac6b6bcb
MD5 74fe66b317d1d739d7ae1ba88e1e6fbf
SHA1 4d9adc9258260aff2492dee10b15b1c6777e1720
SHA512 ee0445ba3c88128afb06e5e7d28d0d857bec2864702ce9090d738e2950933cbd1984b8fbdddfbe2e1e4e76aae045a43d7c76073d1014a109c863295f1308c26c
SSDEEP 384:KD1DZDGD2DnVD1D/DGD2Dn9D1D3DGD2DnKDOeDn4DnLDZDpDKkD/DpDK0DIDnkDk:3
TLSH
T12662BA2263C65BD842B551686562E5B0CCBA12D3716C1840B4CE3E079F3FDE9BAB3B16
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcDefaultTask_v1.0.cdxml

SHA256 d1fa336196a61b2f2cdc2fa0e8dd9db072d72ad6e7b2bc58300b762dbcc7d66f
MD5 803e11ed6ba373cd52d12407b64578e9
SHA1 321f4834a6cffa963443f2d44b6019a6a01b0f90
SHA512 bd4558c6ae0120205a3e9f3b45ec0cdaa621120cb72c0fbba2e37fc333f83d1e7a573183e1b52afc26614b73f6579184c19502247380bea4873f4f0a8ab590a9
TLSH
T1FE31762137CAAAC149B6911C9265C870DE7863D370AD0C40B4CE3F075F3BC9AB963715
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcLogTask_v1.0.cdxml

SHA256 3ea3a4f320845ed6ff4258f47ebf2d9c466824eb44a9d00d160d09036727a35a
MD5 3fc3287306b701229882710a43b08d00
SHA1 e85a8615a411314057d680985bd51c5683228905
SHA512 a2e1e90e454af1bbb248b35dffc2e86d96f2a3729f8dc8b5751abbf9c76350ae2a309b1787e7590096534b6cc2f58d2b47be847d1ba528286e2921d72c25bf9e
TLSH
T129715F2173C65BD049B1516861A5E8A0CEBC53D371AC4840B4CE3F0B9F3BDA9B9B3B16
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcNetworkSettingTask_v1.0.cdxml

SHA256 ae8c0349056d6e162b3d423a0e9c6faac580373f800b2fbc907185d924f0dc28
MD5 15ae68e132b0cb198a622ebc8d71523b
SHA1 ce8e4b4901c6fd05bacc592d2dcf43d9dc9c5837
SHA512 ba7352258ff1a52a3954de58ef61bd416372f0941646608185425785362966bc73d6fa4a8c45829ddf6f8162af5ba332dc5eedc5bee87ab1f75c2372a46f96e9
SSDEEP 96:mYEOlMDNwjsMMDsVDnZDpDXD4D4DomD5+PMDnx:IDuiDIDnZDpDXD4D4DomD5+EDnx
TLSH
T12DB10D2573C56BD445B2816866A1E9B0CEB953D330A80880B4CE3E078F3FDE9B573B16
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcTask_v1.0.cdxml

SHA256 534633ee211af1662bcff0ddeb8f9058f5c11d0784ab043859b630ed3df624d3
MD5 1a250c1932b02c7ea9ad0fd3197da8e5
SHA1 0adefcd459de6f3385110b8c8ff5a31510dad7fb
SHA512 34467814a5108e306ddf80635c887ea3ade3fb4b2e8b449b1fa9fe3c1d31afd5cfdc07b2bead1fa249d913ff9838ca3787300196357501ffc74ceb1352c02c59
SSDEEP 96:mYEWrDNUjsIDGs2D5K4szDnsMDODnsBUx:FDOnDGs2D5K48DnVDODnUUx
TLSH
T17991002573C6A7D645B241285656D8B0CE7913C330AD4840B8CF3F0B9F3BC9ABA6370A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcTransactionTask_v1.0.cdxml

SHA256 42da5609c849364a8f6bd51ce759dd053968cd5cfbb42819e3f7bd69679567af
MD5 aaa93e8ab76b6b7d4385182a93ae2536
SHA1 bef23bb3afc55f46e8116bd3348f595ae4bd3da2
SHA512 77fd61796c704fb656ebea000886d4c7f8603929b1d4cec53956ebe4e96100c6cc2387761beb9528786ed9869efe238f3e44d2caa171e7fb78427a59cbd4c87c
SSDEEP 96:mYE0rDNUjscU/VDmVDnRn/VDBVDn9Jx/VD9VDn9z/VDRVDnx:HDOxgDGDnR9DTDn9JbDHDn9RDDDnx
TLSH
T143C1CE2163CA5BD845B65128A166D4A0CDBE62D371AC0840B4CF3E079F3BCE6BA73716
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcTransactionsStatisticsTask_v1.0.cdxml

SHA256 3e8fd53f1c7e0dc176729db6a665e6315d979b931a757a72b4d4818f9bc268bd
MD5 46df5b597f541ba362d21418850ac117
SHA1 4ff3994c44e373fdcbe7be5d7c624b094b696c5b
SHA512 bad2eb42720960e633d885494cc347b6dbb8afa479932833f09a01598a581f99558965440eaa8aad71b0805ea226b3b3471caf3f25450ef33d8f683320253efa
TLSH
T1B921331177C697D188B2A1186255C8A0EE7922C370695840B4CE3E075F3BCDAB563725
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcTransactionsTraceSessionTask_v1.0.cdxml

SHA256 4b1f9346487f65d2062231e588da9e11c86e0af0384f3350b2d2dfe130f518a9
MD5 886c45ac3cf4e308a16632f345095a7f
SHA1 7158292801af288b9d404b354374f1a847d7672b
SHA512 12165ffe5a4d5d1f767a26af49c703273b5fe0b923faca98a75682167f542ec59110cf55f4a12c5a4c9739b554972bfcc09f824ad224c9a2472d768d7bbf52e5
TLSH
T16A51582277CAA6D24976A11C8299DCA1DE7463D3216D4C40B8CE3F075F3BC8BB9A3605
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MSFT_DtcTransactionsTraceSettingTask_v1.0.cdxml

SHA256 ebd91535d9d0ef35ad934c0d32bde20099d96d63605c3244bc73619a17d2b2dd
MD5 e63e19c330058185a2933f3f83947acc
SHA1 d4b014ba9c539b0e1c7ef0d4fa7edadcd438f884
SHA512 2f56369d72afbcea1a5465e768e88f152cd1e6150e5b6e1433b8008e9bddc3b7a12da95f75cb1bfdecade9950416756b48136f568d4cb3c933823f23acc83d41
TLSH
T16651362223C66BD449B6A118A255D870DDB956D3306D484074CE3F079F3FCEAF9A3706
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MsDtc.Formats.ps1xml

SHA256 31eff0bdb13cc1847329d024abb6ae1223b03f5acd918d1b43f8977311e6ce22
MD5 20ba90513c1dac1ce89cf2ef29213003
SHA1 0fdf4c629c9e7c73fbf947ca770837793537af1a
SHA512 91e0521b69e70a847c750ad1ce543e13792612a6acb972c39d8abb6712dcf5f4f180aec85c137e28d300064bd70bf144dd7e63d8390f0722fd7a5aa3d3d12248
SSDEEP 24:2dXPoK0J1SdWA5oiP37pnp40PwlE2gO6hHHBPP7Wg1CDNdtPIAN7PZz+ny5:cXS1eWA5tTpnW0I+nB3ygiNrDIns
TLSH
T1CAD1974AE6D52E946CF59529BAA8B670EE01674B8C794110F3AD0B0B7FF2CF5053313A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/MsDtc/MsDtc.Types.ps1xml

SHA256 bc1c68a0aa0dafa70b005b71cf4bb5a7ded934b9e540dc110096bca3e9a106e7
MD5 4ee6a8d50c5cd3747f0a2b98e78eff02
SHA1 0a3818a00a97c7f3eb3a970bfb239e30756a126a
SHA512 1c7665da97dfcbee397c5366bab99813522875283c4320d5e45bc70b9be4880d793f5b7631ba50621fc9ee6b3dc2e641139b200c78f9861fdcbfe5edb94d6a39
TLSH
T16241CD01F2ECDD6109B4542B99222AC3EE16A65F493A4076F3DC33175F3ECA8A497633
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/MsDtc.psd1

SHA256 1e1d6ba03f67e534c8e153c7e17acb5abbb8640fee913b32fc76b2bbab7e76fd
MD5 939564c34afbcc324a9cf31a013e1d4e
SHA1 3d138a09b3e910591a83f74833f9072d77644c14
SHA512 fee8cb8e92850aa0aace76fd0d901d942677124f099e4a9b9a1e5706fd8ea9373293e4663ec4bd098a586a4aea2edff51acd1e4d78f2a66f045d794ed1e64c76
SSDEEP 96:wIQozq3aN3aFUYruXC4m4CUdU/mHIASrQYO7ZldUUrXa+XaW050dUUIfrH5G6ocM:wg4a1aOZ44/d5IAS6ld9rXa+XaW050dZ
TLSH
T1E8812F4667ED0B44F9F36F95ABB920228C76BE8A5C2AC99C42404D0E1471D45ECF2F7B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/MsDtc/TestDtc.psm1

SHA256 b548f01cd3a09293cfb7820aad0cd1b715710840850efdb78b2744ed2a734ba8
MD5 9d37d2fe10f3c1f16931ab4b691133bb
SHA1 415e23c3cfa584b348a9eebf6537870bdb3a4d44
SHA512 760e8d956dd096890e08ca962e41069c3f3225a912d2577de3b5394ccc3e9558139b37d277060073cc29456fff8a37c112e32ba5a158cf0541305bdc372b20b8
SSDEEP 384:X6SKl6lfTObCC/sgIl3Q8d4lPunQPQ/GUL1rfmav:K7sN6bCC/25nnQPQ/1v
TLSH
T131C21C2A70029422147A93BFCFC28404FED6603F15761974F9ECC59A2FB665DC2B5F4A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/MsDtc/zh-CN/TestDtc.psd1

SHA256 43757fc3718b8a2b19386c528d1924547c30190b6ef928c3e64316c7280aaaff
MD5 a6ecbcb35b798351128f2da4a531543b
SHA1 8dcb8c6446b5da43703cf0e9cec444c8dfe7e28b
SHA512 1913ea3ae22987afcb718282b15502e25e255ec764261cddc935f930176fcad13d218b72616631d7efbe9b5f6ff1880129c072f7fadb4a103fe3936995122ee0
TLSH
T1E771639117ED5854B5FBAA40DBBA1D768EE7FC221928C41E68C4062E09F1F416873BF3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/MsDtc/zh-HANS/Microsoft.Dtc.PowerShell.Resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 031ff551a248291c1507ab29aee71dbe9b11779302882ea1a114bdbf80155391
MD5 a7210b6fc160a81100a7f2bdde1b5cc9
SHA1 9593ad075b84d0fdfbb7ad31a8334c1249813f12
SHA512 e7723a8ecb9de51f892b996026a2d982f9b08f81048be7ebcc01ff24111fa39b1dc38532529deb970e27a9ea90663147cdb36024084a23b085cc5efab743080f
SSDEEP 96:PW4FXXGk4mLnvfFO8yRSMA4rkAqVP9DRIs8szR6hIQ62gM0ff+wpdEdtUYJ1o6ZE:PW4FXXGiByRy+cOSHuXESNBt0WAGW
TLSH
T15042FA8123FC0A9AF0B35FB57BBB9410B837BD56E931C19E2900016E4E75A109EA5B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapter.Format.ps1xml

SHA256 c36cc9cc863e0391cb7bd5b4c89ab0b40677a9548f25d16d37b441882899bac8
MD5 81003746e32299fe188b85dbd3a07f0c
SHA1 da89aefb0dbb56f5bb574c423f557855b7e9b57b
SHA512 84aa93cefdde8a05540773fe10c7dcafed74166be9932fb14df33e7c5e04a50f1bd9f40356ae7ba9ac85bd4a7a38c1f20ace56132705680d89f10aff99152659
SSDEEP 96:fD0iF3w/JqZFg9wFpD4NsYFrIw/uFKHw/pG:Yyw/JN9wnsHIw/vw/0
TLSH
T1E722090B92D47DC18477C04A6AE861B9DE102127086F79A0F39CAB1B1FBED558733A37
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapter.cmdletDefinition.cdxml

SHA256 1510bc1b21e886e0f619025d259536f820e8aba13be2b8480cecd6031d2814c8
MD5 d6c003555a35956920217636b9a6a14a
SHA1 a1ed73018dce6275583ec6c511a4561b1458267c
SHA512 8b68a6374bffc8d57a283fb6b43932efe2577635f5ae927f2425e5a76f52f611442658fd32e0bb0b9fc4911d436b8ed9e7cbdd69f1cf474818c4d9b91d088455
SSDEEP 96:mYEyertoswjeid3swjeSd2swjeSdEf/wDNwjeSdgD5KN78eSWCzIvqqab:VBiBDuwD5K+oCWn4
TLSH
T1E142781057C92EE842F6111AE975E8B1ED7846D3623D005AB2CF3B1B5F7BC61B993322
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterAdvancedProperty.Format.ps1xml

SHA256 a1f44b15c987896824eb59274d766dea15e1bcbdcdf9a1da2e57ea549a515aaa
MD5 f2afd613c49576a014477f43211bb452
SHA1 cc96dd8b32fb46bed0466c85c46980312b8841e7
SHA512 2f0edbe0919d42d20e10a1986d654a0c815e77b801dbe786495d794d242b4273bbb5f61b8b66b9e28c269ca84778d0e260752d4895d2c560a20825b7bbc5976f
SSDEEP 48:3nAgD6eGnmLfc3gDTfNnfFp5LpeGkN51oc3gcPn3a7Wnd+B1weuMG1y01Z1bRXfF:5D6esifwaptLLpebN5GwJYGe8759N
TLSH
T1D0F1260B53C43DC24572C15E6FA862E9DE25512B082E6950FAACBB071F7FD468273A36
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterAdvancedProperty.cmdletDefinition.cdxml

SHA256 254509e1660d6f586f2c72213ad7e47f4cb13538a9728a7cbcbea0bc2e17d7f7
MD5 8574c39d44af820b807640e2e95b1906
SHA1 c3bc73c03c550a96b57a1edf234e6eb1f6a12ce5
SHA512 8df1ea85ee4281bcad33c265353bd2ce90bbcbd570d290106af123de48953218b65f0d2c43353a40b5a4c9fe9ff84d800266ea518b2aceef46afcb2ca81bc4ea
SSDEEP 96:mYEm0ystzbRFjvFj58eJZWLP8eJvTYgswjeJZPPRjdcjs/Fjvcj5qaRljdcjs/FI:Wygjdjq0cejmjsNjUjR/jmjsNjUjRea
TLSH
T12262351453C91ED885F65019B9A0B8B1ED7946D3B27C0499B2CE3F075F3BCA1B993722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterBinding.Format.ps1xml

SHA256 28dbce575a029a851038b4c90caf07e24dc87239a27e3bb63a31bae6a6a77bf1
MD5 77ed451e033f50d5ac3192b6455c767f
SHA1 5b4ddb5874fcc897d9697d2bfa6410fad1d49df3
SHA512 d2c627c5629856cadc40b91faccfa62e25480768333f81af69196c0cc89ee4e459c2566abecca0c0660d82b3a17f7b4cf498bbabb6332d046807a99cf1370702
TLSH
T1F041240756C43CC28177C49A8BA856EADE15A037085F79A1F5ACB71B0F7ED058733A36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterBinding.cmdletDefinition.cdxml

SHA256 db64403c661e731e8459586861e6768904445ed4103fe3066636e19f723a4cdf
MD5 7851facba71074792ba07e076d00488c
SHA1 5030fb7de29716bbc125ed7c58cf5445b8d632f5
SHA512 70c80d5b98292a1234de59d81f53c9bfe1a0b1cb2934d910f20dd079481fecbd8d52c1d73f6b2b94522614b26f568a0a073698322e8ca8442f77e5e04a424172
SSDEEP 96:mYEW1R3NhDne5RfKoswje5RfKcswje5RfB:RDnYsG
TLSH
T11112251457C92ED841F65119EAB5F9B1FD7846E3A13C0096B2CE6B0B1F37C62B993322
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterChecksumOffload.Format.ps1xml

SHA256 2f569cbfdb4045643767365879953ea30c05945d21b249bc44cfbf05fb4a5d1f
MD5 9007124f88f095d83e02dc7d6681128a
SHA1 135108cea281822d9eff163d421d67bfd2e2a647
SHA512 322d51cfc0ff761a05a7d8dfe70153f0902e5909647639ddb2ed16672160c8b8035fd8ff18ef2455bc83e5bd6aa020cc3a7dcf7c2a1aa9e7181cbf8a0daf5edb
SSDEEP 192:wAriuNigEiLxyixR2ispyNpcecSy0rKi1U:wR
TLSH
T18BF16C4B91F97E81A9B5402B7EA455E6CD1012A7147B3590B5BC7B130FBCDA8CA3383B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterChecksumOffload.cdxml

SHA256 baa7653c70d536c8d6e7752eb40e412b63a4cace508d7036a72f1e19a96eae6f
MD5 743f3a527a3133ee1ab2651e1f3a4013
SHA1 51bc867841297af394c300dfdb7de6482660543e
SHA512 7b9ce0564142cf8f58fb24b0ae215e818a86ca821bbc47faeb0c43779cecf828a3c0c31361b0112884849c1903f40246385758e978fd428072936e0399016029
SSDEEP 192:PDYDCDoDSDuYDaDwDKDgD21DaDwDKDgD2/a:PDYDCDoDSDuYDaDwDKDgD21DaDwDKDgV
TLSH
T134420420A3C91BD842F60129A561E9B1EDB856D3717C004471CE2F0B9F3BDA5FAA3726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterEncapsulatedPacketTaskOffload.Format.ps1xml

SHA256 922116b807e767220d7a2e480fd8e0b9901bc83cc3a14a5319e3d1c4f0639f6b
MD5 52155615c9f94e46ccbe170f1e734ad3
SHA1 95541602380b43e9542ae24754468db73eb4b880
SHA512 2d36089032346e8b798bef91dbb6ebede3a10b92d29433b6567ee558e039608d701c6f15ca9f0d06a28c78d931ccf1cdf6aa1a12a907ddd0bb6c16b9f719bdd4
SSDEEP 48:3nGCDxQ8k/NyQL8NknhBKA/NGEDBsJ4n4Z:3DxQ8eyQiknPKcNGEFsJ44Z
TLSH
T1B7E13526E0A0EEA0E47940AEEE7484B8E9002167446F7151B9FCBE079F7DC954B37D29
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterEncapsulatedPacketTaskOffload.cdxml

SHA256 30fe2b5cf197bccb718f64eb6ccb54282a6f09353b68bd2aabaa908bfe0e2267
MD5 dc2f73d621beb306d008258332cebff2
SHA1 cc794d64cce7ee5567d620b6efa01d6a1f606484
SHA512 e3bb52ca21a2964067340806bc7f5941c83fa31cf6f917166abc3697e963c2eb48ba45504468ddd19d023274e6cb4b31ecfbde6b1e9683f983821a0779b11063
SSDEEP 96:pYEW1qi3ZzF18e53CgswXjfZe53WgswXjfZe5F6M:czFyy1W1M
TLSH
T16112971053C95EE481F6012AE975E4B1ED7846E3627D0056B1CE2F0B5F3BCA1B993B26
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterHardwareInfo.Format.ps1xml

SHA256 496853fdb75b9b43409f5d0fbbf8158df1c2af062a7444e1c8bbd383496b4e6f
MD5 8cc587da62bfb7a9d8ba089c64a745d4
SHA1 d68e19019e725d9c918637c31a85f8e021604f68
SHA512 d2972eee376a6da0f748bb16d9468df1b2fe689128e6267850ad96d5c518f6006f19f5ce02681043e96cd74d032bf4a3589c5a0e47251000edde529d08a103a6
SSDEEP 48:3n//Du/AH4U0ecc3yMmQIq7/RYR+XQIH2xmkDSZZZ0:HDu/AAwBnX/O+ARXDSZZZ0
TLSH
T1B9F1340B62D03D9659B2801A7AB861F5DD11225B487E6590F38C7B0B2FBEC96573333B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterHardwareInfo.cmdletDefinition.cdxml

SHA256 3b81f23fbaf92641f010e186efd8b9078db9838a96562dd3ef69590b68d9d6e6
MD5 91d52319136fc55857ed41a0940e72a1
SHA1 cb20a42d09b62cd69e9e2fdc8351c9d6562d7481
SHA512 48461f90cfbd86bcea4a216dfb5c3d3f9c24d6db0830a3896c12cb3bbcc2d8f49dc2c942b301d57851ceb1e0f506bc0204206312b7f9295917460c9e36d87417
TLSH
T10E31991087C85DD841B79209E9B1F8A0FE686AD3813C0449F2DE6F0B0F77C52B583326
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterIPsecOffload.Format.ps1xml

SHA256 00542164350543c87562ec352ebaab32267be77164a9231c62db9c8a5f7fa287
MD5 f9e7739e68f91ed5ac69f265383a050c
SHA1 7091f1af6bb1fb07ae70fb4965fd59f27f03e5bb
SHA512 2fa97cc627566f1358b324a42053c3067e6ff74de66a848b4c7368d30bff09fa24bdca5efa4e7d6197db710eb3550400166da894f263e0ac9c95b9f68a8e4a9f
SSDEEP 48:cn8kDLKzGF8euKzGSsLodwf2YffW8RVFc+c:QDLyGJuyqodwf2wfW8LS+c
TLSH
T165C1F00AA6D43E852CF1815EBAA8B5F1DE10531B487A1550F7AC370B2FFEDA5413353A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterIPsecOffload.cdxml

SHA256 6ba87b055fe0ea1db73f4e4e77558bfa1150aa10366f66230505d5084c008456
MD5 5129188d6447bc1a7e5bd9bd7a47b953
SHA1 0731f1a97b8f583c389960d030ba65f888f72cc1
SHA512 f41589414d1f2800cf3069947f9a71827972160982f5d234bf0f82435949712b40ed1d7a6bc6fc22f4df3b6054fad852f9410dcdc5192afe53617605cbb15e97
SSDEEP 96:mYEO1qGJDMD2DNwje53PoD2DNwje53aXD2DNwje5cYm:PJDMD2DuaoD2DuBXD2Du/
TLSH
T1EE125510A7C95ED842F6111AA9B2E4B1ED7C46E3717C0445B1CE2F0B5F3BCA1B9A3726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterLso.Format.ps1xml

SHA256 434e20ccfba384950e4a01c725fa8169acab62f5951ba57f7f08cef2e6522649
MD5 307da4b231a1786a84495918f69402fb
SHA1 fc9c50a056df3c616b254a28b96de27227b62bc1
SHA512 1ec2571a9b21d5851af4b3fae72bb03b66cdd5ed76bafa85b737be396a7133aebd473809a287f9d52eb9d5d3d7be5b094ccb9dd52a0fa6a08f2512ca5340027d
SSDEEP 48:3nnjDoTJerJENlKMMiTwxJENlfc6rc12XWZZ3FwcINX/dXiE:TDoTJatMMiTSKc6rckmZZ3FwcEvdXiE
TLSH
T17BC1890AA5D83EC1A8B2812F7FA451F5DE101223086F2164F5ACBB476FBDD948733935
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterLso.cdxml

SHA256 27053cee5b602bbc4f5232b272c1ca25cbef9c147fca0c0cd22fb9cf3df3ee88
MD5 57d925bee9ee46087492f4a63347dd1a
SHA1 af9893ee9766e87e2d3c9763f9321d467ad09d89
SHA512 d6e4058a6aaa5d1d8ba6c5cba029efc9369486ca85c4f40dc40ae2fade0bcf5dc8fed1bad02269828fa3860edb1ff8c5453311b2337c5735406bcd2a2d1c69fa
SSDEEP 96:pYEwH1qzDjDZDx8e53IDbDxgswje53UDbDxgswje5+:7DjDZDu9DbD2hDbD2n
TLSH
T1B7124510A3C91ED841F6512AA561E8B1EDB847D3717C0495B1CE2F0B5F3BCA1BAA3722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterPacketDirect.Format.ps1xml

SHA256 956d8c2b0d3d9bf2065ec63c3bbb6eca9bce8fe3db4b795ead43583a038c720e
MD5 d46c9edc4125acb867f003ba9df39ac4
SHA1 25d77c9e2b5558dc8b99a34c4efccfc01f5d5413
SHA512 5bfadde51677ebd48dac9fd561326f02820eacc3e95fac65cee81dc0c372f7e71394bcce495754751fd802e24158ee07dab2a0bd292c89f3aa8715ad644a99e7
SSDEEP 24:2dniks+DOa/xP+PXzLJZnmg63Jmg68dVMbRZP0PDTe/WtNZcS0P9Py9G2XBXj4b5:cna+D5ZGrthU3JUkVMtZMPe/WtNZyl4k
TLSH
T1EAE1080BA2C42D9458B2815E7EE8A5F5DE14125B487E1454F2DC7B0B2FFECE14633A3A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterPacketDirect.cdxml

SHA256 d62fda37d436844f7c835e1d0f3573285c74973e8b8da262e561c84ae1a645fa
MD5 166a7f2e0b38a8e09c341cb3e32e99b9
SHA1 48bea99336768c44b27cb70569574f962e9f3ddd
SHA512 c065374df28cbbc11a19e54b78207d7b6cb4bce61e8538c9e10462235c65203df77f2c6cebec011235b1711f228adf7af2ea3443bee6cf99055a0ca5662434b4
SSDEEP 48:c2YE/G1em3EDvpDx8e51mCgsNmje51mWgsNmje5R0:pYEO1h3EDBDx8e5ICgswje5IWgswje5K
TLSH
T199F1851093C91ED841F6511AA9A1E8B1ED784BD3723D0456B2CF2F0B5F3BC62B993722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterPowerManagement.Format.Helper.psm1

SHA256 57d7228d727fec39efef71b92a3805fbb57c82cf7d3d6ee9a3a9cb5ba22e4cba
MD5 fb19fe2577179efd8fcd60b3a27fc6b9
SHA1 5cb8b6b5e13dee365dfad28f599596c4f9246397
SHA512 e837c01119ecf90f3108ca16d0295fff6b6b23422ec7855985bd28af8788c6fbaaf9f4c648a160e57cefd3aaba800858e586ba791f66ee1f7bbe542db9080ec6
TLSH
T1636101A6B94BA93A457B133FAD86502CEF30C19349EA0485F55C83DD2F3285083F6E9D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterPowerManagement.Format.ps1xml

SHA256 0a5a7050a065343725b013ab2af721e81031436c869707e223f51f7007084a2e
MD5 424db0aceb5907dfea7bc165270e5dd4
SHA1 bfd3d5231787b18911013a59f1057b792dd46672
SHA512 5457f943fcea42d80d351f99fb32b3f89310bedba38aadec269db33520b64895bf0465c66f41679679a6dfe7d64ccf17b72da12335bcc21167930491144636d9
SSDEEP 48:cg+DZ2cMQbcKOF+fn8wAMHeTe7kxfAXvQunxfACXZiNgajxfATxL:Z+DZ2OboY8wAMHeTe7ke/QuneyajeT1
TLSH
T172F1A40AE6D86D5098F6411F7A68A670EE14639B48A90544F2DC8F1B3FB3CF5067373A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterPowerManagement.cmdletDefinition.cdxml

SHA256 d8801aa416a5238e213a18be1fe7e064001c33927b65f3c8940913ff25af1380
MD5 415fd2034d63a3a19f92e23fd7cf6a39
SHA1 5ef9c5b8e2fc3bd8a206684ec7ecba7f9118c13e
SHA512 2babad5857b3231d5d8294c05a6b6c88c67c3782c1e48be6a1cd518570593de583a1cc8250172247ef5cab832b6704f42f3b3f739c0ca758e280c83c5b666890
SSDEEP 384:49z587z58rz58tz58rz58F/z58Rz58Kz583ZdBQwBO:TZNU
TLSH
T15272F71463C96BE842B6016AB961E4B1DD7847D3316D018471CF2F0B9F3BDA1BAA3B16
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterQos.Format.Helper.psm1

SHA256 d2887f2d82d8593cbe47b4ddf25db6bfe60fa05da458d3f1170b8e02e2b402af
MD5 5c42fa5cb1ac7660eceb3ea58e5e2f4f
SHA1 0b8ab08cf5797ef9851292bba4bc36e155546cb3
SHA512 3b0f835b71f3e8f57b9930310187160f9bc02fa362915e0b3760634907b319f14fa7be59bf42234878cf2a3e9e9b3716204f8376508a3994b152a2969e8c2956
SSDEEP 96:Y+De20wyX4C273eOGIbDRnxDAgJqeaARD/JVmfuFhOH1VHXdD5MtgGkT/HIg+LC0:v0zIC+JvQ2P3RiDXHXdD1lT/HIg+LCQt
TLSH
T137B1EB187A0EA77E5177927AEB5AE07DDB3C521391302421B8AC46DE2F31481C7F8E2D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterQos.Format.ps1xml

SHA256 fa92de3f057fc4e5dfac7c3cbc6fbf01cf436efdee2f1baba52a64732ae5d7fd
MD5 fc6fea9bb9efce71a108adfa44c42f74
SHA1 dfaf617dae7f198d119919a513b8fef147047a2a
SHA512 c5f4803b4ac68d3a31f77e60bdaee91cf8087d34239d8dc3db28ab7e768a23fee37aa5a59344b91cdea1f708e2899f3bcb0ede8c43a09c1cd17e6fff81c3f826
SSDEEP 48:cno0DYSdrsXKvM3eCqQISJ50KC255VYQIR:+DYSmXKvM3eGX6hE5V9C
TLSH
T13BD1E80AE5D06E906CF6811BBA94A1E5EE14134B887A0100B2DD7B1B3FBECF4467353E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterQos.cdxml

SHA256 a08ce5230d3462fc93a0b1bdfbfde387e253100f1d6f8d20f1c7d465fe6f557e
MD5 8e0cc7843db86ecfbd15cbfca82113f6
SHA1 08c5b59c830c2c5d9f3666dca4ed0b63408aeef9
SHA512 47c352931f99c499d55ff2f208e5848a684421e1e4f08e8a649bfd17fce061a8c33c396e46271257752503af9a41f1a3fae7b6fb15fe18212311feb41f9408bf
SSDEEP 96:pYE21h3EDx8e5ICgswje5IWgswje5hFgr7rbbu:lDub/fjy
TLSH
T19902781057C92EE841F65116B9B5F8B1EE784AE3623C0455B1CE2B0B1F3BC61B993326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterRdma.Format.ps1xml

SHA256 4c2976e83147836ac2bf6e926dcc03b8f57d20802fdf6d2adaab08598f19ebca
MD5 5ea9c9083de00f658c96756b9fabdbbb
SHA1 d361131dd8bda26b636f4b932cbf03a327cbeed1
SHA512 77e76cf4f440149abe11aa4cc9de8957dd64bc7a5347e9bfddc2f9943db1829af57c888bc408dcef5904950890257bd72d837f393821b9deb2a7c00f66101690
SSDEEP 48:3n7vDjIiTxqqM+/0u8jkcNw4RIdcCMk11TkDW444VHXu:bD0iTwqM+/0uewCU7TQt47
TLSH
T1B6327F0BE6D46E9568F681197AE9B1B5DE14134B8C391004F3EC6B0B2FFBCA4053363A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterRdma.cdxml

SHA256 29ac1b9aa7f81a007ea41af031184672a9ef3acda1b8dab2e8ef3d7bed398ea1
MD5 eba9d6575e3b36d371d02b170e2abc75
SHA1 de84ec69dbd6b840c8639263784a1fbabf3c803d
SHA512 769ec2dd59da7f61739da9c3ae26c338ae0a1dbbdab518081decfad6716561d4d76689eec94fc53a9aab633838cd119976f5b7023f7eb62e02a3ae0d68c64772
SSDEEP 96:pYEYVfGIs2lAPl4kYL2lAaC4kYL2lx35a7ELm:/Jbq2bEpSEq
TLSH
T18902881057C92ED842F6511AE971E8B1ED784BE3623D0459F2CE2B0B5F3BC61B993322
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterRsc.Format.ps1xml

SHA256 5cc8e8ff3c0245234802149804b1a50d315f67afb019633b14d178ccd0673164
MD5 a3e70a902e36526e43be7d690c57a277
SHA1 f7af21cb68041a5fd25819a803c77d964a4037db
SHA512 5a9f718b9862e51a5372a363dab9d6356a7616fe27ea4092c34399e6c8912146262580df74094f298c4588ae76dc8aa85690f357a713b67ea9614f60b04d470a
SSDEEP 48:3n15DWpHXeMe6jo7Fp+ScE/QQ/Ccnij4zZ:bDWpHOMe6jo7FpLcIQQznij4zZ
TLSH
T1FA910C0B63D03DC159B2855A7AA866F5DE10621B0C7E2560B3DC77072FBEC95823363B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterRsc.cdxml

SHA256 366ffe0606f65d716052bf8e446caa74e7bae4a2fba07b1ab557b7a067b85eb0
MD5 40267aebfe0461ef7d4163105c1335b9
SHA1 58647e244f36e697ceb59ee681e1548200c0a3eb
SHA512 047a7a23751e810eada168b4734413a73183a0822a9a1dd4a8c608a4b00dd60128c489beaefe75b45175b753301529a16766c071020fd4abe94b9334dd374bce
SSDEEP 96:pYEK1iCjfmzXZ3YDZDx8e53IDbDxgswje53UDbDxgswje51Neg:vJIDZDu9DbD2hDbD2op
TLSH
T1C5226620A3C91ED845F65116A571F4B1ED784AE3717C0095B2CE2F0B5F3BCA1BAA3722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterRss.Format.ps1xml

SHA256 617a02f9e38b8d8e55379e64319c1e9d8ef6e62dc24ed22049a533d45c703b7b
MD5 0c4a3b43d5b017be225338851077209a
SHA1 c7b42fbd4bec5105cbb612acc84330504b5362e6
SHA512 9d10846a4d17e5fb52ccb800b3d5a1b05ef01afbac1acea423094ef5d878f3e7b1395372e84033ab71a2f8af153427ecfbe93639d7b48ebd30a8e617a64cc8b8
SSDEEP 48:3nFPBDw5r0fQIZ6O06U69OuO9EZN9NRNIWsNIWgNtAuNqr7WKWrqKj5iPc6jmvOd:bDw5w48kVs7AVvpEqKj5ikMtwYh
TLSH
T110C17B0AA5C83DC280F68119BBA455E9DD105127093F6970F29CFB4B1F7FC518A73A3A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterRss.cmdletDefinition.cdxml

SHA256 8a5c7ae3f5a1a6dd181ea5492b9b028f72b85f0ae45ebae3218282b1d8cc538d
MD5 443bf38ce911a5ab7bd34047e5e7e485
SHA1 49ae1bba5f98fe401b89b84dfa18b217e7c9e795
SHA512 68d0c4eac1ae77ef6f900f70af40dc570e60a72e499a45a28aff99b2a39a3307776597bd9ad2c539fc1c7a15a032e974619e576f297e92214c0750da2f92e474
SSDEEP 96:mYEK1qoDQDQ2DlbDFh3DehSDxhkDdD+Dx8e53Cgswje53Wgswje59B:lDQDRDxDz3DcSDPkDdD+DuOacB
TLSH
T16C224310A3C91ED841F65129B562E8B1ECB846D3717D0055B2CF2F0B5F3BCA5BAA3726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterSriov.Format.ps1xml

SHA256 32adacd2af92df6d299f63548a8f0d743b6f2044b526ccd5412341465aa04f77
MD5 f2526dfd4acecebf8fa9d08abb338e44
SHA1 20e98b757f95b68fdf86af4bf22cc1e9526e3c38
SHA512 76eb3aa4ac9d73a85df9daca29fbc834d70e48bfc09e711a189590a1fc64c2868d0aeef3bedba55f49c7c3f37f5783d10baf4e1a9ee7ea225a66a28745675e03
TLSH
T1F6713B0B52D03DC185B2805EBAA855F5DD14625B086E2460F6DCBB0B2FBFD954B33A3A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterSriov.cdxml

SHA256 b15115218ec4c69c94ca7a8bcbf660b15c843842270dadb83af528991fa07b16
MD5 fae0af01e863d04d10bb652e2e8c41c2
SHA1 b3ee9fab28e4e821af1b13eb187dabbfc1abe4b7
SHA512 1b801a2de42820d67086d59296b8ce931d9881c7e1c87cba4dddfbecbf0552c26149cf03bb271091b3086ab4e807e20c83023a263a98bce933c055a17ab699c1
SSDEEP 96:mY82tuGcgDWDhEup5PtwM4Dup5aCwM4Dup5zJVE:HNDWDWaaBTYtVE
TLSH
T1A222571097C92ED841F6511AE971E8B1ED784BE3623D0459B2CE2F0B5F3BC61B993722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterSriovVf.Format.ps1xml

SHA256 d6ad3ea4d3e1c7e17f1901b1785e4d75f5b137965da81822d8f8ca1e3d9f1134
MD5 33cfe1caf96359a92e5365e3437e9fcc
SHA1 56a6fcca3ab0d8344774651ae6a2270cf54228ae
SHA512 a216708ed8f26a37d01938c5f5ef3e23aa79af7362fe72250a5cfc4db27a5e70081ef48ba900bd0209571d40fac973fc3cf853df76e498160c51e01884f7da45
TLSH
T15B51EF0B52C43DC28137845A8AE855F9DE21A127081F3DA0B6DCB71B0FBED058737A36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterSriovVf.cmdletDefinition.cdxml

SHA256 063713d6f5565ec5f7d51746ad56743c1a3239cbc658d3df79503467dd7efd8d
MD5 716e63ce3b29e089524f5e46253dafcc
SHA1 4524eb1bdaf862c20327dc8ded946ff8fbe0fa2c
SHA512 834d979f5681cb0f00db3014b57897dfa9da80c6b44c09d15104f4d5e5340fe78349474742efdace183c999fceae3c35bbcccc223a2b1f94b3312076af87d46d
TLSH
T13A41270497C86EC845B65109EAB5F8B0FE685AE3917C0449F2CE6B0B1F77C52B483726
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterStatistics.Format.ps1xml

SHA256 381317b48d91710db3ba4fd899fbd8f4d8a1edc7686b4c618980d6baf9ff7df8
MD5 0b8da0eed25b08238a110ac6f29cc692
SHA1 c7d9a8d03fa51dda99c45141b6a2b4e6aa257966
SHA512 dc344d3cf0fed770a904efcf95eee02a3d72b362777a100e63c6e7c32f2baeae34e15dce1bf5fb19f603e62b86b044e3129c228fbbf036909eac4f815941c48a
TLSH
T14E51FA0752D13DC28273855A8AB855E9DD156027085F39A0F69CB71B0F7ED0A8733B36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterStatistics.cmdletDefinition.cdxml

SHA256 7a96e4cf8687c31722d4ee538bf48cd4749462c8b7babaed49d9d5d6ad88b7ce
MD5 389a7553d83a073c447473491e629f18
SHA1 4b85b96c51eba77b26541c707489edfbfd1dd2d0
SHA512 72163b2c14265d3ca669fdf43e288aee26284b10ae8bfd44a28419f7f9b9f6a5c1891d249532aa9f16dd09571d85c46d1305f09010b228c212d58b9e720ec0de
TLSH
T11431991093C85ED885F6A209E9B1F8A1FE685AD3913C0459F2DE6B0B0F77C52B483326
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterUso.Format.ps1xml

SHA256 d9143aada48eb30bb214463169391a3f522a0154ff5aaec1ae2de50da88a6f8b
MD5 9ca00d375d40daf84d99c3878ad4ea86
SHA1 06622809c91c9e3b7fd46f46f0fafe8531fc92d7
SHA512 3167703d7e121c8090ef784778b76ca70546e4c770803cb6e40daa42a31550c2459301615372aae54525386a0f577f2fd8212f07902291cf717bb9f66d839abe
TLSH
T14C716F0BA6D43DC1A872411BBEA451E5DE1022270CAF6160B5EC7B071FBED958B33536
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterUso.cdxml

SHA256 5a1dd6623cd064b00b3d57e019a6cfb23508b482e2b21f7f9201415ea85bf1ad
MD5 27f0aa4af863752276edc31a36d0d732
SHA1 e9d3bc456ad535b432016f970724cf24bcbb0528
SHA512 8815d8b2b3cb9932a02f05ca0eb0b1ba1de311242a906938d3028ebd0d4a3d60bf838d6b3316c3abc9581e31aa2a2202444060a5199be4d74dcb6507171c08a5
SSDEEP 96:pYE8H1qYDZDx8e53IDbDxgswje53UDbDxgswje5+:UDZDu9DbD2hDbD2n
TLSH
T156024410A3C91ED841F6511AA561E8B1EDB847D3717C0495B1CE2F0B5F3BCA1BAA3722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterVPort.Format.ps1xml

SHA256 523cdbd926cd3a5cfd04f2b45e5ca0f4dd288f7112f1a66a37fddc0dc02bcebc
MD5 b4e29a050feb33386bd424ed10c86517
SHA1 73d1b3a834871ab01a9dff39c34c148737ca8055
SHA512 2fa33e362c1ec46d1857a468e830041a89d36da94a2c40103271ee9f1c31a2c872e15076a70192518647d2a6a0ad6336c1bc99c536a1001668ac971b207f0789
SSDEEP 48:3n4YDMmWYc3g7LbogSLboWuZuVWuziT4WXJq9M9j10QIh:XDvWYw2Lbo1LbofZuVf202o9M9Hu
TLSH
T1B4B1250F52C82CD2813785568BE552E9EE219127045F3990B68CF7474F7E906C727E31
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterVPort.cmdletDefinition.cdxml

SHA256 cc173476a9371d17e69d394a7173ce198bf03759b8837a31ae17ecf2dad48b74
MD5 a833f301bdb5ec023734e9c441485704
SHA1 e0494a74dced02463e04882f454ca220f678b80e
SHA512 b4ac1eae72bd792b22289420a7290d527da609f6bb606b301cc67fc44aba460aa766f27cbe5834f5c54f4013c538981bfd2d08edaf1a00379d9cb05d39d1941f
TLSH
T10451450497C82ED985F65205EAA5B8B0FD685AE3517C008AF2DF6F0B1F37C52B583726
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterVmq.Format.ps1xml

SHA256 58b784f3592d08726c82ccc02223bb65f8e3e988d25a8cfc7897a920fe9e5015
MD5 41f6292c499a35dc9894ef75ad7779c1
SHA1 45f94e183efabb4d4bef35affe5f835983cc0e69
SHA512 6a665cffc935c47750e028196c9c13aba5927bafc51a39fe3f1d6f073ceaf640336df1416690d8332b02362f11675dbcdd46c8d118e37b8691d8295b1b9e7174
TLSH
T1CB51120B96D87DC28177844A8AA855EACE216127081F79B0B69CF71B0F7FD058733A36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterVmq.cmdletDefinition.cdxml

SHA256 2d755d555204f459f1826d87719a89bf76d26547dc661ff9f3689c0c18c7dbcf
MD5 35e9cecd60590ea95c6411dbf17b4886
SHA1 6baf997cca019e881afd3f37808b0e200fc8ecb4
SHA512 be6c61089644d16f05a18107a1bdb7d8dac7126b1429d906b3a91eb3996f23e685f6c07b6198e1bc8f99d4a3b75a7b23482e76e723069c30024285e7375d6018
SSDEEP 96:mYEe1qH2DlbDxhkDehSDzlD2Dx8e53Cgswje53Wgswje5+:tDxDPkDcSDBD2DuOan
TLSH
T155025320A3C91ED841F6511AA561E8B1EDB84BD3713D0455B2CF2F0B5F3BCA5B9A3722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterVmqQueue.Format.ps1xml

SHA256 9d0e5d0594be2ee71f070f04cd1ad347cfdb3b08e51cea6a5c31cfef5fa56692
MD5 1f1fe928d3d1481bcab83ff8be18c45f
SHA1 8001fcc3a0bffdde6ed400e89e0814d06443cc53
SHA512 9adea9ee19dbfa1d8db4d75c154a03f7621fb71b78efe7bd0b62932515b647fc2738d1987fc725abbd825179c5a95d963371ec65ecdf502a5015dda62c5512fc
TLSH
T11C71360F92C83CC2817384569AE951E9EE106027041F79A0B69CF74B5F7FD0A8727E36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/MSFT_NetAdapterVmqQueue.cmdletDefinition.cdxml

SHA256 7dd22810c50096d4fa873f96aee6f78886c30a66eea35457d9cfe7af8b9365ea
MD5 0c2ce5f9ad139ad42d4420dc4d70506e
SHA1 039aac49e9b5d79ad1a5ef7fe00c634a181cca1d
SHA512 eb38319fdf78fbc0c6d25c1b14a5bb69fa71664be8b40b75fdebd4db121151fdc32157f845f68f9128107c1e932c8eda2fe434b1401b1ff37d77d49706a6bead
TLSH
T1DB31660487C86DC844F69209EAB5F8B0FE685AD3913C045AF2CE6B0B1F77C52B483726
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/NetAdapter.Format.Helper.psm1

SHA256 ec12ad3fb2b7f67cfe18a0dd2c9cb6304872ca42433416adbc8aea081a55a482
MD5 70bf7e04fabe5a2a652ae18cd7aa7227
SHA1 1ef55dbe9770255d4559e3582e52697c5ea8ce26
SHA512 d42deafdde82f1e910ee51728d1031bb1f26bffde110373ce90d3753a8e576ac7eb483c8bb49068e166b81415e2b02a810cd8b500fde7eabe0d4cf55207a1d4a
TLSH
T1CE61341DFF81E116517B157D8A9AE00DFF16912BA6190462FE7C82C42F72D14C3A5F4E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetAdapter/NetAdapter.Types.ps1xml

SHA256 9c16576e5adc5d00864c2a2697b3c822fb1e4f27a02219f575e0f36dab8ad3ad
MD5 7deab770a2799de151bdfd42d5883347
SHA1 be3a2a25b84e51338e5ca9f60532504c1cc295d7
SHA512 698d7eae6e2db4bfd0e808e8f9d172cea5bf4f5c5d9011d03dbd71b74bdd84178cc3dcf936cf98b81e178c92b4b473b423a99fff57b58eecf48ad5b715ac7a9f
SSDEEP 384:RwlhAMAwo2cujQEmElEdE6EHEhHnAbhYvNYa2I2TAugchjuwqh:u74wo2cujaH5vNYa2I2TAugchjuwqh
TLSH
T123238811E6ECC89081F5501BBE27F5A9DE22413B007A9198B39C5BDB6F39CC19693E37
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetAdapter/NetAdapter.psd1

SHA256 7d14d943640182f3bf394e463dd50ed997950f5491160e9958542da5cfc468a9
MD5 8a300b36783a749cec1842995e7c221b
SHA1 35d6758ca1e9f1992a708060b049b40fb43d2724
SHA512 7014c5dea79e71c27973589db1a2603e67e9d8a5e594477e7c28e821daaa331ad717f67dc88893de55215f24895ad4db1969e26d1e4056057556f9a0c943731d
SSDEEP 96:G+DhD9DfDRc9Ep83ZFgFV+FDjL7FXOd7r3:89IROJOdn
TLSH
T1AEC15A70860618A0D0B783EF7858AC73E6587B7346BC5A963AFC454C0FF7C425786AB6
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetConnection/MSFT_NetConnectionProfile.cdxml

SHA256 913e202824e93e1b0a225974dd9332f0080f60dcc90461048e3b6e3fbfe175a0
MD5 2542b553558cd6f70ec960120664137f
SHA1 6b75939fc93d2f9adb3d0934f928b6bcc911f8f5
SHA512 78adacfcd308a8befd43328e7c043db591eb4b9c29e201548055d8510c35f3deb666a355f1cc1a4e192bc5e41f288ffd0c9c241e9d5c152d6e3626edd1c68182
SSDEEP 48:c2YdmUZxZBYxFCmrgmN0Llxhxh2dxXXUUXBPXBQy:pYd7vBYxF1rvN0n3h2dpXUQBfBP
TLSH
T15DC14A1517D92CA647B21110A5B5F4B4EE248AA3837E5812F3DE3F0B1F76D8138A727B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetConnection/MSFT_NetConnectionProfile.format.ps1xml

SHA256 3c59827a3184bfdadd404eb32f7fe808906f691b8ebc433d7a9a336173d9d53f
MD5 118c361fc520991326221fe9b020b852
SHA1 3930cdb458602be9593ce403b43b4b7aa89fead7
SHA512 41e36f530e0549517c71432e5dadc37dd9f971693621e78f62253918ffd10eded675f1dd40151c9331a4f596d99dacf8be2f9c522198d5e61ec16c541c074b98
TLSH
T1FD21840BA6D52E9169F151297A94A670EE20674B4D7A0014F3AD4B1B3FF29F5053323E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetConnection/MSFT_NetConnectionProfile.types.ps1xml

SHA256 59384314b46553336f4c46d837cefcbf3d6cb6136104f94ec2ba465e6b2ff088
MD5 35079eff2d5a988d4544540ab3c49675
SHA1 268ce09824ec10133e3aba8127845765ac422a6e
SHA512 64071ef1f9143a5dd3d31974f4a1f4ee1bb56c70789e531dc357735ced243419bdcc1f87459b051db6684c11411f5681cf240059cff4ae44ea52c41af203db6f
TLSH
T1DD418D10A6BCC8E053B71007AA62F46DC820116B4137F1B5325C9F47AB3C5C5A7A79AB
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetConnection/NetConnection.psd1

SHA256 d04ed7425dfb22db4e61ce32bfe60d9bd16c9f4c5380f264a1446bb68e156a7a
MD5 3b6088164266cd46193f155c4ea1ea15
SHA1 088fceeda8ef5ab7e3441d3c7f6b9ae17e8d70ea
SHA512 f58dfc97b6a2d324cbd703b1f1900641f7eb942b99d7204ad0f9f3d1b904dfaa83465d86a3343de07e95f7f17d99407d30284424bf5e2eb8081e5c8e67a88216
TLSH
T1F5019967501C2057653B7516B18E140DF2BC6BA3021BC852B169D6C80FBBE8692996DC
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventNetworkAdapter.cdxml

SHA256 6355ec7ca6972fa5ad39d5098d3fd3510d90d862e4696d1075af06141011469b
MD5 ff2a6e85d158b82eb661a278209b0af2
SHA1 ffd54960c3d2cbce3df5ba02a73a8ef65bc97b37
SHA512 6080091a9d6e3ccdff0afc17c43879b563be125fa295c25f3060c5192ca272988fadd3ca7bb0fc67e9c1793f4de492b464f61b2664bdf742a695dd45f8f6730f
SSDEEP 96:pYE3PCj4lUK1l0Rl9GOf7YlkK1lsRl9mRzcrGRmMrHe:8wBU9G4QRs9mOK9be
TLSH
T186A1AB2163C10ED441B5500AB765F972EE6482D3A23C0506B2CF3F1B5F3BD657A93726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventNetworkAdapter.format.ps1xml

SHA256 6acfca4a288af9ec206f32cecead339d90fff94e16ce5957220962f3c83d64ec
MD5 b03b2db693a0f8672c5e009fadb603cb
SHA1 a477683a6a4e3c6356d4e6d8a336c194d672458b
SHA512 64112103a80ef91264f427d1027a4072cc83d815f692e8ad1a132fe4ccb92e38bcf5f875c1bcbe27f902d8eb69ee97af442d86f0c26ae5a1fdfc3bcb414fe242
TLSH
T15E41B50B93C03AD119B68419BBA86679CE21621B0C6F2560F7DC471B1FF2DA5463393B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventPacketCaptureProvider.cdxml

SHA256 080440de410aa7da41107adfc54792e1d058d8381b5288754de8022c9ac9f704
MD5 469f829cbe250342f7287c7e12c4cb65
SHA1 21a5db6dce2d326f27e20c88116e18ee66b99610
SHA512 84c42a4f0b1b792ddd1b2633ae619d0688d4fd04658a9680b8b3433400295f95d2b74ce24fd1146b67c7bb946b4c2323d8ffa6d0ca3b186f04cec6cdf4a5036d
SSDEEP 96:pYEDlAlm/tUKLv9C7lYKQS6yZHqEDOXypf5iZjOkHSHjBy8lDZDXPUEfk3ZsOvyl:bYot59CRH66IyqJgBblrSWspkDQa
TLSH
T10312212133C51BD541B1A1296692A8B5DD7C92D3726C0404B1CF3F079F3FEA1BAA7B25
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventPacketCaptureProvider.format.ps1xml

SHA256 2d57220046856b8a8df9a687ffd13f8b89c9d8e0edaabd0bba96c2e9159849c4
MD5 906b713599d6e8e21ab96765873375e9
SHA1 b97260e1bd73a540094993257ed9c6ac5b37e6a0
SHA512 24c9e411bda020c25e80a13fce3a162d5e57f6226092ce53d536011ea6f3766b373a8867c53e827d45ccf309dcafbda646546683e299b432bee6da06ad97bafc
SSDEEP 24:JdJlhPRlEPTxnuIkTVBvxlnJPRlE9BBBBBBBBBBBBIRpnWIEjVpbU:3Jlh5lexnHkpB5lJ5lRpnPEZp4
TLSH
T173B10E0FA7C43EC219B28415BAEC6629DD11621B5C3E2960F79C871B2FF2D564237A37
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventProvider.cdxml

SHA256 726a57e2a72f25ae2f0e932e7e8c76f427f4ac208cd1443acd14f32d987911fc
MD5 8aeea8b84ea06ccd23596b7472f2af37
SHA1 8ebb1ca9ea03b2c4c37454e1c820bbf15dac444e
SHA512 9f8ed7e1c0eddd6413d22c9f136d51682e9733155ea67e342c1e8af8475ee610b59d1c657b027bc9f282a979f1f4e2793d141809c01df33444c6dbccfa351f43
SSDEEP 96:pYEjKujtUKLv9C7lYKQS6Of7NkK7v9C7loKIS6ozpqX+DMKymlDwDX+DMat:BKmt59CRH64NJ9CRf6v+z3Ur+zt
TLSH
T1C3E1DD2123C10ED541B260196355E972DD7852D3727C0505B1CF3F1B9F3BEA5BAA3716
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventProvider.format.ps1xml

SHA256 3ecbd7b91d15b6c612498ecb6603bae4962338371e9ad830732271b396973a72
MD5 29eed17b7003653bc50f6125efe2c7b9
SHA1 790ed252508bb1d3a4a2f411c7d742064d121272
SHA512 28d9c42ed155a89dddd0617d95ea486b635710c100e547f9b8cb57d09e7a580a54163fafa5a538542353e46af2f6dce7a9441d162ec4c2db8871c193ddaabf76
TLSH
T18051820B93D43AD219B2C419BBA8A629DE11621B0C3E2960F7EC471B2FF2C564537937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventSession.cdxml

SHA256 37aab6ea73be67cd520058152248255736f61e444f6108e22706964b4dac3147
MD5 98cae93d3fdb2e80b079c63f8d27aea6
SHA1 ca8c8be864aaeeec943aa2fb4057aed463bc6c92
SHA512 c99ef4aba3d0a89ad7e92f706fc70d980e55abe420768ad18477593508682682c833ae4a078dbb8e2c22d92a6f1822269d54494014a0b02f426c8c707e43281e
SSDEEP 96:pYE5jtYKN0vF9Xyz0NoKNsvF9fTJcPD/opipcOJlDcSICoqRU9u:rtXAF9X/NHoF9fdGaA
TLSH
T147E1982063C60EE542B15109B662A876DE7886E3B27C0405B1CF3F175F3BD65BAA3726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventSession.format.ps1xml

SHA256 c377f91d8a012e43d16d0396cab7fe52b10addd389788650779cf882af9e10c7
MD5 5a64f5cc29a2d08e8aafdfd049273a47
SHA1 5cb58c437b25ca2a2c20b8c0691c9caf1171f745
SHA512 b6bb71c07e5301dc5124172949c7fe5584f506092a83a9424510468ea6126b8d4930af49c9e25e586cfcf646654c24be7a441f671871a6abffdab0415b9bb829
TLSH
T11961430F93C03AD219B28519BAE86629DE25621B1C3E3960F79C870B2FF2D55453393B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVFPProvider.cdxml

SHA256 c6453bd3ff8d4cb4235a59d30c18919b27e98d66d74b877b6082ffc1d4e446bf
MD5 96f8386a8684d9a54f473d4d33416ebc
SHA1 7cc7864a94f4c452870d4515eddcdd6cc6164bac
SHA512 e6c0b9ca379c87e5c5315dbe782d03095ae7b8abc8fa01c4cee35f54ae8a6cfa7fece9e5160e71c69c3e22e7e210b840a04894975f59b2a95bf31ae4231281e7
SSDEEP 384:pIDkDyDEkDU7DcDiDLD8DUD2DKDyDXDnUD7DUuD2DE7D3DHDSDRDoDNDpDxDAD5/:A
TLSH
T1DF42F26563C51BD842B1A56826A2E8B4DDBD13D3306C540475CF3E078F3BEE4B5A3B2A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVFPProvider.format.ps1xml

SHA256 aca8ec825a6f8c32c9b94960d591b07a215e9df8d17ce74aaaa4cd84de4323c0
MD5 a41403742b94fe5b86de0838aec637b4
SHA1 5a67186fb066b4b385c8354850d4fe546c12468a
SHA512 1ddf238a64f0ba9f11dbf955beaff0af2c36b601b0a832241182e0e7080f9ca502b97c548d959d2733ad08f10f310a8d164f122b330425e0fd228b9ce7d86a90
SSDEEP 24:JdJhPhEPxRQpveM1Z4t5G1BnJPhE9BBBBBBBBBBBBBBBBBIRFRopneMtZ4txWtU:3JhZmG54t5GJZjF2Z4txp
TLSH
T137E10D0F67C03EC619B68455BAEC6629CE15521B0C3E2960F79C871B2FF2D56823793B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVmNetworkAdatper.cdxml

SHA256 9e474cee5053cd1f9b17f798f16e476d49d9bf3e2b5c7fb38b2dcc845ed13fd1
MD5 ae3b1852c80b2f3ad90f81e4a08b928d
SHA1 81eec8003574442e9aac3a838cdbd483df89100e
SHA512 1b955ae1bf06cac8f67cd2d0e9a90f49fe0d4dff93a40b2b9ea3dfb4cbe5dfbdb0c952044b330764193c4c374b1fd171eb43544a9bbe1942cea8b34406261e22
SSDEEP 96:pYEnj4lUK1l0Rl9GOfT4lUK1l0Rl9GRzNmMpe:FwBU9GowBU9GTpe
TLSH
T13981CE2163C10ED442F6500AB765F972EEA492D3A23D0506B1CF6F1B5F3BD25BA93326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVmNetworkAdatper.format.ps1xml

SHA256 77ffee03d27d4cc8e488e81e10434aa1d0fa334f40359459eb00738753b78e61
MD5 d6d810df1e56603c3f54269479789713
SHA1 613ce6d87bf47dcf6d55cea9f824938bb7932d4a
SHA512 94de38c56309cfb1297a6cd4c71cd709438ace7773087494130e3ea7ce804cb9fa11f829943c730b21a8fe624f6bfa91c02b10dd167231fc7ff95836f3640880
TLSH
T10861620F93C03AC219B68419BAA87639DE11621B0C7E29A0F7EC431B2FF2D554633937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitch.cdxml

SHA256 c99e21ad6e2b263defa187b199f74059505a47ee9b12acb95c6709c30fda999b
MD5 bc172e6473c205dfc39814e5c8e1eae7
SHA1 16bcf11e3f7cee5d0d5d794ed704114a22d86d98
SHA512 eb2e1926598f0d87765d8232a09a276e8ba17a48bc2e2519b53dae29ed7eb332de555332b8b56e9568de969c1969783113a3e5e2fcd4c3e164862d4b5440cdb2
SSDEEP 96:pYE/j4lUK1l0Rl9GOf7YlkK1lsRl9mRzNmMpe:9wBU9G4QRs9mTpe
TLSH
T1D881CE2163C10ED442F5500AB765F872EEA482D3A23D0505B1CF6F1B5F3BD25BA93326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitch.format.ps1xml

SHA256 70676591c78caf3b8c6db7cdc7f51fe3e442fc6f901ae84e02fb82b6be4860be
MD5 1232d8be9072cace8c3c27b0e055652e
SHA1 047a3f57bc0ceff0febfb06250188ab62440b50f
SHA512 15b25bd55ab16b2f6d61fe92a474137dab57bd3796286d0906a68b177bab01bb657ef98880b7931043a25dfd69d1dece930f1edaf53db795556b0f06e5f9b345
TLSH
T14F41F60BA3D03AD109B68419BBA86A65DE21A35F0C6F2560F3ED471B2FB2C654533937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitchProvider.cdxml

SHA256 5327d592dcf88253a70b1eaf9d07373c86725f8229872867da11f9c6171d07fb
MD5 8c13f00df778469b96a07f12784b94e2
SHA1 95e4ffd9c2e7794229f4c511b1f0bcb75c9aef30
SHA512 0e1fd19662558177555739ad50d673a6cf7abfb525e29e377aa495793fbdf20f48b9b61ea7e4898bdc74efc250f8092f3157c43b7efdb523ae6d4eae270fe32b
SSDEEP 96:mYEKBm/tUKLv9C6yZnqEDdOXGeDdNDnd8lDBZDPeDL++DVNDd4Dng:FBot59C6SDmpDjDnkD7D2DC+DrDWDng
TLSH
T155C1246163C11BD942B1A1286262E8B5DEBD52D3717C040475CF3F078F3BEA5B5A3B2A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitchProvider.format.ps1xml

SHA256 ac552d0297d5ee6552a684d17c082693322601a72e11f7663897417529af7193
MD5 6c43d2844295ca4d62b04b163275a784
SHA1 d992f77471cac5a59cdd1d9b10b2d3edfe0a172a
SHA512 e2f4d3125c327d4e21e56d3ff0bf4f77d314a26d4eb763e47c236d9bddbec8f12cbe4b4e3e6d8ca426574c663fd50ae00cfe63a36d7b0bd7f9ef4f7f3c98d8a0
TLSH
T1EB61440F53D03AD219B2C415BBA86629DE11621B0C3E2960F7ED871B2FF2D564637937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventWFPCaptureProvider.cdxml

SHA256 3990bc1b3db2120788e7abb1b069270cd9bb876ef02043c99b9d0dd932b709b9
MD5 435970a385c6bfec811a08da4a6f0ee4
SHA1 5a15542f579c3b1863ddc73488bca1945aa7cc42
SHA512 6bff5046e790e905d4c588834eacb59a6880aa7590f63c467872aa9a87b56326be4b662c0ebe02617d43463ae2d678431e7ea97588bcf3646b06539302be1a5a
SSDEEP 96:pYEAltlm/tUKLv9C60ZnqEDOX0etqmHmlka8lDZDXPfetqmHmFJT:m/ot59C64InqseKlr+qsuJT
TLSH
T1A6E1472123C51FD581B1912966A2E875DE7892D3326C0405B1CF3F079F3FDA1BAA7B25
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/MSFT_NetEventWFPCaptureProvider.format.ps1xml

SHA256 01e4637e9ad8a11775c98bb243bc673acd1a888719e68c645feabc1491e2af14
MD5 83ff235a54fae78a873894bb1c4b01d2
SHA1 f2fa92c2bc829b2a5fafc8a57e6cc4c16ef204c3
SHA512 74dea259c7dbdcbe4532fa259a5b41ce41ef82a49eb6b5217bd9a3279e54de44f45abeb224650028ce3147112640c5f44962248ab6c1ff80ba2e8dc2a3792721
TLSH
T12B81300F97C43EC219B2C415BAAC6629DE11621B0C3E2960F79C871B2FF2C554633937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/NetEventPacketCapture.Types.ps1xml

SHA256 cf4173d3e5985827cb472a77c61efe9d3c939fd27648a1c955d9c8c0c27e4695
MD5 bf34693ada2841282757cf5b50dc684a
SHA1 e6024a3cfe67c7e1b0d783a1390550082fb083a5
SHA512 90a4c59de79a15a81f23ac65f11b86fa3d63b80a6f7fe2986950e96a4e3bd5936f3ffad8c53e6606fb20f66cc5ac242058c717f0d4a4a551c11e6b792b96e9f6
SSDEEP 96:pZ1Dh28u8kedNOtM1ledlQwN9qhUy2hAFOt1uuMAMOtf:Zh28u8kyOtEednbqh6hWOt7MhOtf
TLSH
T103C1D560FAECCC9085B49007AF76F859DE01517B803BA698725C9B876F38885DB97C36
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetEventPacketCapture/NetEventPacketCapture.psd1

SHA256 1d76b227495890ac0a04bf4c5a05f6e31ab5ae87f04c7cf8be525d2b6dd6fa31
MD5 c12f67233859e908ff20e48e12316bb8
SHA1 5cb825ddc70c2b69e22a90bb5869886ecc5646bc
SHA512 96453bb7221554080c74bf5676a4d63c9eaa0e6bd1b4e2b124f2a473bd85d31048419d37a27ca5f1ef49fa87c164642f7b80283d746a55209a28dfdb88dc4b51
TLSH
T1EF517C3682070CA0967186223B84AC02DAA457F78368095BB57E9FE4CFF7D605F839B4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetLbfo/MSFT_NetLbfoTeam.cdxml

SHA256 743c452d5aadda348e251e28e4941d76c822c6edc8ab0a2e4905c4fb950090e0
MD5 a346f0e93e3b6239ede94b570fe04b7c
SHA1 e959919756646cab0779763acc4c714f09f5f0e0
SHA512 a33c3ea9c84c823bba47d915ab39d36ee63f64676943ed0ca0b566e5cf49a6477a775431f2354cf00e3064cc1a84e7c3d14dd7f378cb289b495d40ed65136414
SSDEEP 96:pYEXjEKdynGK9AyzpEe5el781yJlu7FVe+nBelqGQWmHfxwnswjVde4KbZVp1d:luu24uB8+TX6dTLKVD3
TLSH
T13BF18A6427C20FD582F111196A61E8B5EDB882D3726C0448B0CF3F1B9F3BD65BAA7725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetLbfo/MSFT_NetLbfoTeam.format.ps1xml

SHA256 e825bc188ff2a2202a86e25fa64101d81fdae255bd741adf2f2295eda3ad6823
MD5 b11297862bd0eaef3d3986acaee30acd
SHA1 3cc3dcebd848418a7e126bf030866003c89fcd29
SHA512 48daab9ee61b3ba9e03beb93369c15539bffd0b1c8c8d3fe906634eb1116209dd92948a712dbc796c82bc253f1f2095002ede33af4476b2fc7931e8622eb48d5
TLSH
T11961A50BA7C03AD159B68415BBE86629DE10621B4C3E3960F7DD470B2FF2C65813393B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetLbfo/MSFT_NetLbfoTeamMember.cdxml

SHA256 10989b4f2b921f097a347f6ce7e0e18b7805e4d6eee13f8e23d44e8ab34bf176
MD5 f88b78c8e3eaf0608848af4d77ebb934
SHA1 f07da9075b5beaa1c3010c70236781ace6b9ada8
SHA512 416d88bb8014b544e8168af44d1ab8de79d94d72c97cde7a01e86fef43b8e4496f2b62fff47cc4a39cc736e60da95f695855215f690619a4dfaae000aa6a6a03
SSDEEP 96:pY8YMeOKnqyJfCzKgoxu9wkq+pTaWauVu:2GEdYe5+pTxjE
TLSH
T10EC1EF5423C61EE542B1011AA972F865EE7886E3623C0809F1CF3F1B4F3BD557A67726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetLbfo/MSFT_NetLbfoTeamMember.format.ps1xml

SHA256 d31ca9becc8572ddfd6426488018cf37027d45e72cb2194c3ceee0cd4d4e8036
MD5 c9313e384a41e076185deebfa6d56338
SHA1 5953ab10f9e1bc89075b4579a6a165c117f5cf3a
SHA512 a92581562aefb4bc63abebaa6582681b2e270e965a9a6ac243903530695077bc7b803526aee383ce7cec1fea2ee8703df1be6819b53df50d81e97d993fea0b81
SSDEEP 24:JdoRPQmT4bziYi4fBRB4UWw3JPQhQKIKsR4rusU:3C/4/iYiSBRB3M3y4O
TLSH
T1B9A1C60BA7D07AD159B6C016BAE8B529DD20611F4C7E35A0F39C871B2FB2C954533937
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetLbfo/MSFT_NetLbfoTeamNic.cdxml

SHA256 c2058523fa272372325fe3751b3e4f7d6fa17c0379603b522b8b25165ac7caec
MD5 ff30b69f4f9ef073f636249df6a447ce
SHA1 57ef0aa43ca26c2e8678a265d89ca725fd5df3c7
SHA512 e7aeaddb1eeed5f834d083184334f43cd262fe5b1ce094cbd2a61c6f2e753541c54f04febb233af10b88019f9875a5ff41eef85b685c3f15414c5f218746023f
SSDEEP 48:c2Y8/myPf9i5sUKXObsoYmzteE2mNz3kumoW0f6w+0Jp0j:pY8+yPFqKXo3zteEpR3kRoZf6wRJpe
TLSH
T1D1A1BD1123C21EC582B55019A6A1F8B1DE7886D3B27C0408B2CF3F0B5F3BD95BA93726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetLbfo/MSFT_NetLbfoTeamNic.format.ps1xml

SHA256 cf1e54646cf534c0bfec6c438211aeff2a1f12cefa0a54c86749f6599115bf42
MD5 de1546a792a505c6f531e028e6250ba4
SHA1 97c2300ea40ac45b3624592e141cf91e54866f4e
SHA512 e8792f7ef2022ccb587edfd77c5afbb8277593952ecdc068309e077dac68a1eca5958efff3c96a0436c583d0477c58732363d8ff3876d8c1d2c420aaad7fbaf4
SSDEEP 24:JdCPzT4oUVqiYi4fBRB4++JPWJKIKkR4YEV7U:3C/45wiYiSBRBmR364hu
TLSH
T140A1C50BA7D07AD199B6C016BAE8B529DD10621F4C7E75A0F39C871B2FB2C994133937
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetLbfo/NetLbfo.Types.ps1xml

SHA256 8c88fca63eecd62aad4fbbd3ec5252d24d9fd4d367f7f4c4dc2af85bdadceeb1
MD5 d58d421455e0c87eb7c4c190d147268a
SHA1 f13721c81546cb5180cd832a7a6207906cc1d550
SHA512 84d35131a105c8216a2df1e117288ce8833975b36662c47d8d6494612fbaec60b4b03d8a2ab987c6cdd3a455b290abd3405af95c18c45f8f3a113b51bf2634eb
SSDEEP 192:2iM/MxuMoPMoOZ4X493CLgLoOM4G4q3dLDLj:2iybpxu4X49SLgLob4G4qtLDLj
TLSH
T16E12F750EAA9C99080F450466E22F46DDE50513B487BA1E9739C4FEF6F38C84AA67D33
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetLbfo/NetLbfo.psd1

SHA256 338bc01674e013961802d9e33a2ad936e5f451987a6efacf6356e5460d47dcc3
MD5 e224c7f85194c5fd9f3247fcefb9d494
SHA1 d4ecb6183c19328dbbd5dc7a69d1d3171802bc38
SHA512 571e813adef3d2c10fe3c41ab6241dfdb2b6f69ec71fba5d664e103f1613f419078307fba99aa2bcdbe5a8f34fa4c52d074829ffab3c5ffa3063ec1f521d0542
TLSH
T11221CFB8441B0650E07682236C45AE06F2E44B7F9060AE0F75BF6F8C4FB2D53B7826A5
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetNat/MSFT_NetNat.Format.ps1xml

SHA256 74359d7dec7e1e43f3f36b64df5f57de508d5e2dfdb8742302a81ee711412629
MD5 4ab71743546f3b9ebe4b0087e5e944e4
SHA1 38da43164d0cf34b1a86fe21daf29a266c2d9226
SHA512 4a93e22069be418b88c48c2b545665eb65c8540d3ebcf215335af85e289134c7460a0d7199f354a8eb5e84cae9aac65b31fd61c456f7cf5afd3d619821186fd5
SSDEEP 24:Jdn2wDOCP5qxTOXVZYM16PFCQ1G3PguQCoIKK7qPYT39C2/CEpxP6c3HZEc:3nvDtxqdOXV2UrKsHOA393/5J3h
TLSH
T170E1D04EA6D52E552CF54129BAA8B6E0EE04574B98790050F3AD6B1B3FFACF4053313E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetNat/MSFT_NetNat.Types.ps1xml

SHA256 630091e245474e21ee0e4d3d48a75484d38e9440bbc41bdc16acd368adc4d64c
MD5 74d76faca07fe5028088a2637500e663
SHA1 085a8829ccb5f724872651e86cd8b026adcb7346
SHA512 619195720c2f2168e52b02c06d49b2a3a0f114e6c80e9295af0e0340309bd4e77b19a8197f34c5f96be28a46c6ac8019b534d12731bec4b462df4c55c39b6ab3
SSDEEP 96:pDMSa0jVl0g5F0g1p0UwQst0UArvNZv0wQst0UAaQst0UAMFM01D:kyvhbhb9c9sNF0c9p9cID
TLSH
T12BC17E21EAFDCCE485A4105BFA76F8E5CD1012AB803BE1A4754CBF876B1D884D75393A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetNat/MSFT_NetNat.cdxml

SHA256 930ef275739595f09f77970a54e0c0d6883344edc98e1e8f40f37de5c11f168a
MD5 febac2405c7fe8f97683c29e9c4052e2
SHA1 a8bfccc7113ed82c758e5b021d6fa42cc64347a7
SHA512 95a45ac56c212ac4c0781346593753484b9b2925a6f7359b07b979beebab27e65ee8e2e7026eb04ee7c9e6795b0d38f15cc7b67a218c8cda3503958df83baad0
SSDEEP 48:c2YG896wxEmWu51e2oYnEa9ZSm1ZxmnOtB000K010aL81hPZttD5J:pYG6TV51zoYnEajlrEpTxya41hPZttDb
TLSH
T169C1682127C65FD642B15028B5A1A8B1EE7886E3727D0441F1CE3F075F3BCA5BAA3725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetNat/MSFT_NetNatExternalAddress.cdxml

SHA256 b574c3d2f19e931ffc7c8ebd166123a442f42e6b6e0e855ceb773540ab6daf88
MD5 fb276b2a1635e2aa08c80ac91f741ff7
SHA1 707c3b107699a029c106f22a9dde15fc0f813f48
SHA512 3184edc2c2a5be1b72b161ca1c3edcc9105dd943a876780e6fb5aaa001fe77d350592f74e08ff7356fae0885f7d3e274d71e6af3c14baa2dd95ada23580fc3fd
TLSH
T10B61451123C55BD946B15018A5A0F8B2DE3886E7B17D0802F2CE3F075F3BCA6B993726
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetNat/MSFT_NetNatGlobal.cdxml

SHA256 8af8241fceca6cd5a5e367275e8eb23deac2315e3d672812d76520f4850ab760
MD5 0b258384cab35dc07486a4d580f45204
SHA1 edeff2f964fedfff0f9e1997c297b7d012a444d8
SHA512 d90998706a5eaf696b24d0f07ce64128b3bff560e63ea3d6ab1b2e352d69f47d48b616f9b4b91a444b02b9d8890eb2b19680ac7e83a7a029a04e76a30d184149
TLSH
T142218C1107CA8ED94175812CA611FCA1DF6596D3A14E1849F4CE7B470F7FC66B8A3378
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetNat/MSFT_NetNatSession.cdxml

SHA256 9c9f92c7756f6d20947fb71505fe1a1578f63251ec20dd2b9a265cb0f77a7b0e
MD5 5afe60944764bea907164e44c75b67b6
SHA1 48df53473dfe1dbf38e8533337279728e3f2a595
SHA512 29ecfdc8827457b3dcb489b18b8e1ed90c4b5e631e366db5211e696bef807e2b587940472c6845cf15a8be22c7e08690805f0f337bb11491ec6c61d175c2222b
TLSH
T17DF05C0093C086D54532D20C9795EC40E774368BE0396949F5DDAF070FBAC4BB00736C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetNat/MSFT_NetNatStaticMapping.cdxml

SHA256 7681c1363eea68bd83710c9f9a845cae75ddba4a70ad002aa5288d79e5b1b6db
MD5 1e9334160b05f87d0e0f193bd567220a
SHA1 f2ecd98a5cb1f58eca8c368c04c8b93702f32c2f
SHA512 4e25590939c4c84b6bff5442a8e79487d0db95aafbfe7fb955b433551f3f27c7487941d0ebc5196745ec2d1394946a591b226f6d6df2c8c7e2339beac6364712
SSDEEP 48:c2YGmEzC+mc2ZRZzmOOtWR0JwP0Rm07y0m0VyK0aLemXNJ:pYGpmBzZvi8WJwsR1W010xaqiP
TLSH
T17191552123C65FD945B15028A5A1E8B1DD7896E7B27D0452F2CE3F035F3BCA2B9A3325
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetNat/NetNat.psd1

SHA256 95827868da2e991180710ca91421997d2a57aaabbcb864787a32e10cbe8458ed
MD5 81a9416aa405e9231a2bbccd5d982684
SHA1 100952e6f2a9d82701822bdc8bc1e17c29e0060b
SHA512 0571ff98e3386ed217b28c53d5e544b8e26b725fa7f8c503e6adb2724bab6cb041ea3ffaffd461879c33029c395211f68a805e5474baaa84020af364194aa637
TLSH
T1F7215C7F40BACA5894768263614C6C03E56837F371B909B6B9BC5A440FF2D5642C26F8
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetQos/MSFT_NetQosPolicy.Format.Helper.psm1

SHA256 23c5c7e533bdefb7f511db967e427106fe6f6d925846b4242a90cfe78e6ec2d3
MD5 d2c09ce0ad5a10463759276a262d1695
SHA1 5143be62fe5ea47c09df34bc6cdd4328e4cf6db5
SHA512 258055e5440aaa9a30add13197a3db0998cbe3ef89fd39e630ed0a1c35fd991fa23f14fbf19d8e1e979235031ee1a54e4a8eeba99586b3fb66f102293a332d0f
TLSH
T122F0818C7949A107612975A1B6158106FF6C711BE2774A52F99412E41F3ED00C11DD5F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetQos/MSFT_NetQosPolicy.Format.ps1xml

SHA256 654b6c53568b04433a905963bac52b4b63cb7d8ff7607c5dba497d9ef331224b
MD5 60dd6040e3ed4f5b8df8ed1c488ff50e
SHA1 cdb53e2ad1ca1aaf6d009e4fff5b4436d9d8311a
SHA512 797602293c662ee7a75d5449f36cd00d59589fbcb7be3db97c28ebb7bd2b0aff67eb6af0a73b17d9ee14bbabca5cade78a6f41874415eb4871e47328f757309d
SSDEEP 192:dL7ULb9LY2LeTLnXL/oL/4JLlIErJLlI2LTLsLK7LnUm:dL7ULb9LY2LeTLnXL/oL/4JLlIErJLlv
TLSH
T1F2E1B41BE5C46B565C7FC013BAD2B1A4ED24026B49775000F29E9BA71FB68B0523BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetQos/MSFT_NetQosPolicy.Types.ps1xml

SHA256 816cf941508d82afaf616d7fb101d9d8a79b24e1aed9eee4ac2c310f90bdd600
MD5 ded58ae5c552cb7ab40d1b943e2525d6
SHA1 efc080ff63d99aefe4f7fd1570b066e3c33f8cb7
SHA512 77572db065e5982ff745035a5dcd4d1cdd14b6ae2e8cfd323edafd056dc6636c2291f8b16e60a9972cbc2be94059eccf67102cde9b06e600e4402a56df72cda6
SSDEEP 192:8NMCM4Oo/OpOjMqOVOyOdOUOBZf/OAOPGo0O8O+OPOOOld8:8NXswgEzgZ2p4Zf/bpNhlQpMd8
TLSH
T144424B21E6ECC89141FC50475E67F5A9CE22017F043BA0A8B29D9BD76F38D819697E33
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetQos/MSFT_NetQosPolicy.cdxml

SHA256 084944f2eea172b984b9de66c333deb831baf508b74db765222293e91f087078
MD5 1bd9371e146efb8a2373976f160d65df
SHA1 22f603a9a0a13987301c4a34ab4bab3c9a2639d9
SHA512 cc1a79a6792e213c85a67faef68f5e49551be1c4e3602ea262c86b8f65d1312cfd6b1db015d10b82261c50c0685145dfceffc6cfebc556708ca6421de4f561e9
SSDEEP 384:+DiD5BDdDUDcDdDkDQDGbQYDTDsAD4DFD5oD5jD5hDn/VDNDiD5SD5eD5dD5cDch:/
TLSH
T18353334523C01BD546B520A835A2E4B4CEBE56E3B16C0011B1DF2F076F3BEA5F5ABB16
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetQos/NetQos.psd1

SHA256 b20d5dd72ea0216c082367828449bd5efc63266cc062aa6249054130788d6794
MD5 cb589227ccdafaf811c9123be62b8002
SHA1 42dd4f372fc33d24948e732da89fde71f2497a74
SHA512 3140d971eb7756e5a86ebafa7fae65d893678845c461ac936ba821ddbe34c987a82050de956289951619f88dc22f0410b06557d5ef650510777a898b1d88fdc6
TLSH
T18B017BE4480862526EB7926360485E4AF2ACBFFBB2268513B57C93140F7BD42C3C5668
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/Microsoft.Windows.Firewall.Commands.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 64efcd06744f73b8273c969dd48f194951ad66a06cf141117750942fc9b1824f
MD5 d9b8d91cdaf9c79693c5bfbf030cf623
SHA1 614576ca15103432b58b74126366d16e9385861c
SHA512 4f841a30fbab3f2c8cd23344c071fa4024229453ab38024fe93756cf0f6000d9e26f7fce95af51dc41c7c493702b3c8b864e6e063d4a9dfe6146266fa449d0cc
SSDEEP 768:UkCblp3c3tJHw5M0PieRfZMsB/6u48+IXxF:RCblpMYjRfZMsA8Fv
TLSH
T1ADE2090477FC862EE6BF1A38B871A869067AF3163532D71D4DC4589D2CABF814D60B36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.Windows.Firewall.Commands.pdb

HFkiller_full/ps/Modules/NetSecurity/NetFirewallAddressFilter.cmdletDefinition.cdxml

SHA256 3cf638cceb1d58f23cbe7cb30d6a052702c6d3c51aae1924d88d25effb59a6d9
MD5 4cede23a042744e7f94e376324268c39
SHA1 5a8f8c1d9c36ab4c6b14ef9dcd850dadf02f31f8
SHA512 3cc5d37b32a6ae9c62026f90870fe5b68c603c1402046bb18f472fee8ed0e31ac752e7624a94546a8d2315befc430533376b778fe7f48159803fe89ede7c2487
TLSH
T10E818C2123D25AD581BB6115E354AD62EDB452C3B11D024AB0CFAB1B2F3BE2BF693305
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallApplicationFilter.cmdletDefinition.cdxml

SHA256 1a625d3b4bef73993484ce15de0fcb7e8a2845f136b81bb8dd83bee82ca4d097
MD5 d89d8163c0bf29c86f9ca3decdec9840
SHA1 2c3fdbe8c936d1e9eaa348fff629822bdcf86755
SHA512 6ee440cb0a7281a605e2da46ac9ad317f2429c21d5f696bf2b4244f8dc029a4b0efbddbb733fea803cc750b3ef7b23f50c73b1503afb70c3fba941269a8a2c15
TLSH
T10961331023C55AD981F65118E265AD72FD7866C3B12D019AB1CFBB0B1F3BC66B683325
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallInterfaceFilter.cmdletDefinition.cdxml

SHA256 be7fb78b1e95714a4b825dacf80057cb8c614fff87b53c6c264a86a502c2a802
MD5 b7f3763c6e6214a1b2d65e9b57ccbecd
SHA1 413a737805677251fc16724d450d72f324a91760
SHA512 d62c69d8bed4560e853158624e65dacaadc54d0cc7cf5a7f28d0196802229cd87f0a2a961c964ee8ff7a9c979e6b14c03e194801da5d3bbebe99b92e5c88e952
TLSH
T15151862023D64AC481FB5119A355AD62FDB563C3A11D014AB0CFAB1B2F3BDAAF283305
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallInterfaceTypeFilter.cmdletDefinition.cdxml

SHA256 62b2bae6ad5acf437d32fb877271d64575eaf50a8ab777cab43f0208a59a5bd5
MD5 06dd6bcd27e214dbb8ab5f87e6667195
SHA1 68dd93149d9f9ef5aaf59575262b461672bf5930
SHA512 4d3746ce2c672d48b3c01278dc268d93dc6fc50ca0ea11b8dd0773646c34980f6f2d585babb393847e801e74af8b65b92dbb5f333591d70b453af56f809f3a1d
TLSH
T1CF71882023D55ED581FA5215A225AD62FDB562C3A11D014AB0CF7B172F3BDA6B283315
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallPortFilter.cmdletDefinition.cdxml

SHA256 60d8c2d146fb0db9a14c11a3551855d192601b69ed96b10dcd59ac9ddcafe624
MD5 9ab360dedb89920dd4f2bc9dd17c6f78
SHA1 777dd79afa4bcb982cde7616241289ff0e2cbc7a
SHA512 542596b0ece302a8eb09312a0ab2a031392fdc2891d937562a747e780b6b52c7324116aa12e893d1ebf7ebc375888c5cf1e09ffd9a651465c57191c098fefbc7
SSDEEP 48:VYEKBeNE+8WM5skKRCf7sF45skKJYCVRs4EuzmMsB2v7RMvhQ0:VYEUeK+8WgKR50KJYkEuiMsB2v7RG7
TLSH
T182A1781023C50ED581BA5114E6A5AC72FD78A2D3616D004AB1CF7F0B2F3BDAAB683716
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallProfile.cmdletDefinition.cdxml

SHA256 e093c5442458c8c1f8c1616b23eda1714170f2d91b85ca5794562e54197b8f46
MD5 e930e816cdd92847dbc134af954352fb
SHA1 9be0bb1ee5c1e1b55593e199e4f4544476b64af2
SHA512 88c66f082ee72682908ac9636c4029e5702e6e10ad0d5af09d3792a5718fb0ea11afef9636578cd7861f3a15d812e425e18aad2b06a9ecc51bddaac7f5d14864
SSDEEP 96:VYE1f2FKR5CFKJYbFKjoEuiSeqMwo7e/e3eWeCYeJemewe3GQuBezeBe5LgLuGDk:T3ViRN/MnvuTcrG
TLSH
T12302661123C91FE581B66124AA64A8B2ED7826E3715D0086B1CF7B0B6F3FDA5F6D3314
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallRule.cmdletDefinition.cdxml

SHA256 179ad50c254574c424c868e75e5dacdf7d05acf0871b2732d136899b6e81c4a9
MD5 44e843a7078e3a23fa8e353e07a4d40b
SHA1 4eb929773597518b6c1273b8121dc522c659fc18
SHA512 9d599eaf60a8dac8e7b470e8d108ebf37db6e0ff75f7dd0d3758181a1f2b59ab797968e326ba49f068a16d6c9e8671ae3bd5529fd3e6dc54a68e26a9e6120722
SSDEEP 192:/umSHbdpP2k60D/lOjoRRMJTKYZzCWvMJTKYnR28Rq:/H8DRMJTKYZzCWvMJTKYnR3Y
TLSH
T154E2671423CA2ED182B65114AA64ACB1ECB856D3326D0055F5CF3F076F3BDA5FAA3724
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallSecurityFilter.cmdletDefinition.cdxml

SHA256 c3b985e9098c5842818fbf27d9a8b0993a6b3a0b167c160fffc35aa128af9bae
MD5 20c7402433da42505a9d3821fc94834f
SHA1 b48a2831c96e1b9733b881f80b4626b1ba719cd2
SHA512 7e672841e08bda3ca36ab3fc572758984beb580b616820e8485cdcc53c114cc885925394a0d76c2eb1a33e6208299c67257c5ee2777e411c8270e80fb4a99280
SSDEEP 96:VYEv9eSe3eNbxNwx8iCjRKR0Eui0uKabSzSbFJ1b:O9ON3NnjjRyPX
TLSH
T15AB1211423C95ED582F64215EA65A8B1EE6856E3313D004AF6CF3B0B2F3BC66F583325
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallServiceFilter.cmdletDefinition.cdxml

SHA256 6eb759630b1796d56dad73ca8037c817ac5bbe9a5251077329f6b55bed9749c0
MD5 bd98b0e265479453e30c33811717f958
SHA1 8d031f9a4e7bb191c334c1e8c0e570bf73c01cbd
SHA512 6ec841aa19007a6cc169fdc970bc330fc096f0e254ff6b3551cafe8e3e9166d03a0fc5457952598258e43677d9f47c003fdca38e3df7e554c1f36431ea57aa4c
TLSH
T1D251462023C14AD481F68228E655AD72FD7566D3B12D015AB1CFAB0B1F7BC6AF283315
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetFirewallSetting.cmdletDefinition.cdxml

SHA256 9b953e6eea5deddb77d986645b40ff7364a71f22335a08347dee6719a8ae10c1
MD5 25bac614f8c6c9c32df35f77b39a86d4
SHA1 b3311152605ac8443fa9fefc17a65b3224b58f8f
SHA512 4de9b709ebb71faf77345fe14e84edc413ee26a105328208a72f80389f902f8f7e6028e6190eb086a038821f831c68030a56be3fb6f4f320c71264f1186e1387
SSDEEP 96:VYEYuiEWe1eeVBZsev1XwNlwhh3QqWTsDNAku2kbyZ0yXCyAwpyl:fRpwUf3WTiqbHJyQ
TLSH
T1E2D1765417C86EA182B24668AD74A870ED7856E3314D004AF0DF7B132F7FCA4FA67724
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetGPO.cmdletDefinition.cdxml

SHA256 bbd234eadf2c42a38ebb75a09dc2a319e85025858394ec80f539d5a4832d159e
MD5 3775422a39093f55f968165708c2303b
SHA1 f7f234819522d3a05648496f0f9f28e39b0c1acc
SHA512 fb96e3f2759593971f227009ceb9c5612a5787632dcf15debd9091de4e26da93dd7a3ab36666772ac024f674ff556dbda96b1b2b631c5ee46fa04c06f2642239
TLSH
T16F41E22427CAABD14572911DA694DC72DE7892D3316D0446F4CE3F075F3BC52B9A3B24
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecDospSetting.cmdletDefinition.cdxml

SHA256 f76889f42a82c961d642e7b6807b3634b7cddd9d0c1a80e2c680c0e8b564d268
MD5 7240fb66067f301dd479610c47214eb4
SHA1 6ae7ccdc67925b67dcf641d1f9ff9df2e3181f54
SHA512 c8aa5a72d4814f3bffd6298f1bda6e7e8570af0f72df7a4eb9f766b56ee0f45e2fce013c50dac65f0a7abc891be52cb05accd6f7e5e959b28ca7775675fc235f
SSDEEP 96:VYEwkxuB7/9Wb5I6zz1IL2vurOeQz+cPuSgudWs0jKdSHTS7KLDTY/9Wb5I6zz10:kJQdX1KaM1Vm+gPQdX1KaM1nC+gW
TLSH
T19642C04463C92FDA85755018AD545872EC78A7E3329C0056B2DE3F276F3FCA4B693B28
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecIdentity.cmdletDefinition.cdxml

SHA256 a8057d208a15a14e769d2b4dd681e444cbe9a7593a1ca4c9644785c07bc895d3
MD5 68e4154a392e11e0bff2835564ac043f
SHA1 dfe4103556b671d8f5efbb3f57a7a204cc62371c
SHA512 1a040475226a5b9744ab2497e743c689852a0a4a4ce2776945240e01cc17777f05bc72a66f5686dcde7bea0004f36ca70a058ced849961e227f9ebd93c3f1108
TLSH
T1EE2104804CC8FC368675CE3429B56C44EE7A95A3420C5858F0BF7A231FB34A90A2F2B4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecMainModeCryptoSet.cmdletDefinition.cdxml

SHA256 25e255590f3a77ae81e4e70feb28766b35ca92f0108c5de98c9b570a1d9f65fb
MD5 d9a2de25c285e6f7bb34b5eb7b99f702
SHA1 020438ba95af6c3b6c136a123e28f4f0d6a464bd
SHA512 6ad7588bd9ed8bbcdcb74b85f66fc98562dddfd0fdbf8317762c8ecda36606f899adf1906ab46114b6cb1475f5653725a4634ab23d9098ca49b9003ba17a9558
SSDEEP 96:VYEjQmnWEcefeDuIWC2ce61e4eMel3ejiUKjoEurTzZoWp3phbx9RnE8jsk9lvia:BSumS7nv60D/lOjhR1ZzG6B
TLSH
T1E742431423C95EE582B55118AA68A8B2ED7847D3323D0055F2CF3F075F3BC62B993725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecMainModeRule.cmdletDefinition.cdxml

SHA256 9943c5f92448eb570e68fb9866059fa7d0c5c6bc63d0906db8a2400ef8b96ab7
MD5 983267d727f468a37c44a8ee6d8b2c21
SHA1 cb1745ebe8a215ad0ebf518b8a7e909d7bf8f1a5
SHA512 a872d24b01d5c5d9047e1b325f6be7464cd5de660c7d2de4c2a5052abe32e6f188bcd2c702d2646755dc890c8fc93ee4207de8495239ca5a4e93c5c1d921fa89
SSDEEP 96:VYE6WEcefeDuEen3eK3e61e4eMel3ej5KdzhKcnKs4HHH4KhQ4++kEurTz6ebpIG:JumSHOB60D/lOj9mR+MVZzCWcMVfB
TLSH
T14F72881423CA6EE582B65014AA64AC72ED7856D3327D0055F2CF3F076F3BCA2B993725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecMainModeSA.cmdletDefinition.cdxml

SHA256 e2ac10ac29ddca53609bb367bac88351533a47035a69f614f21ffb3d293e6024
MD5 7a30cd759bb0e20a45f8925dd13e9dac
SHA1 7d5b2d19069b511d58b6788b4c92c0345a6d0bd5
SHA512 66141f2f53cc797ae34bf18173a1475fee5fbe476003cbbc36991b1891ff49ba471e1c6c635b7a9a896e4c1637ce89b8947db9b28326e70558383e41c30ec967
TLSH
T14E41AD10A7D55DD9C2B69109E264E962FDA496C3912C014AB1DF3B1B0F3BD16B783319
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecPhase1AuthSet.cmdletDefinition.cdxml

SHA256 a59fbbf35b9127ed9924bb9db97f3dc76ae752988fb899af6aad3452125e7110
MD5 c1b0f1fae2fb0b3a510805ca6523fd02
SHA1 ec2accc006bb6aee3b352d9443dfd2f6bbdae662
SHA512 f4097e202c78de43b081e5559f42cb7d82325744ba579e1e2fa21a93be8c9a56c286e074361af7917f901bb0adfa6a1eb0ed6b32bfd6e48b1e5eccc2bd0d736b
SSDEEP 96:VYEifnWEcefeDu61e4eMel3eju6KJYdKjoEurTzZoUhbx9RnE8jsk9lviCK8OhVg:PumS60D/lOjuZ6RvZzM6B
TLSH
T16232541423C95EE582B65018AA64ACB2ED7846D3727D0055F2CF3F076F3BC62B993725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecPhase2AuthSet.cmdletDefinition.cdxml

SHA256 c91e591f95cd79302fe3edd4238472e421e198f1bbe4cd60280b29caac5ac557
MD5 5fcad9f9178dffc1ab1e416548286830
SHA1 d2fdfa800b5dbcaee1543261442504d349a1a17f
SHA512 4cc4c36f6226ca1f8cdbdf3b868e2b3388462d33f4700591084f12af36f46665356874b9114d6623f3d75fceb8c822775d4aa8f5c7f1fbf069daf84874dbae99
SSDEEP 96:VYESWEcefeDu61e4eMel3ejuSKJYkEurTzZoUhbx9RnE8jsk9lviCK8OhViop/ls:lumS60D/lOjux3RvZzM6B
TLSH
T18C32231423C95EE582B65024AA64ACB2ED7846D3727D0056F2CF3F075F3BCA2B993725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecPolicyChange.cmdletDefinition.cdxml

SHA256 e609a15ec0ee6b112a4092193c1bd47e9fc2447af9a68d3bde6baaebfa64daf1
MD5 0013cf2b0c1250a967d4fe873b382774
SHA1 73956a512184541ce212926aa0640fb8422ee98b
SHA512 0cf5d31ef53f0ba2515135ae7bbd536bbf7a0ca5ff51182de0cef63593b8e6153dd409af95f121fccc464530cda46b7eaa32917e475b93d092222865143f3a92
TLSH
T1B2019E0058C9AC6284F6C75464B9AC45FF66A19741881449F1AD3F131FEB489491F3A8
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecQuickModeCryptoSet.cmdletDefinition.cdxml

SHA256 c22735da93b9da06502837cefb1178331e6139c1a28f59f1dc2ceede212cfb92
MD5 bdf579eecf9eaec4901c3e6abf94e811
SHA1 7a6cbba677d1a91c14c169192e01a721fc198b50
SHA512 99f21a898b2cdf64bb5626e561375ea848f19b591115bed46d7c169ff3cd974bb36925bb8cb297c35c21b290fa563c783c55cb05710ae384f3a9f09d4b840dce
SSDEEP 96:VYEAqnWEcefeDuIP8x1e4eMel3ejuIUKJYkEurTzZozuChbx9RnE8jsk9lviCK8E:WumSpx0D/lOjug3RcZz56B
TLSH
T14532431423C95EE582B65014A968ACB2ED7846D3727D0055F2CF3F075F3BCA2B993725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecQuickModeSA.cmdletDefinition.cdxml

SHA256 76aca78b5783b7e04764a0ddac2dde863085c17a4df391b7ac21eebb99804327
MD5 585021595554172b823396445226be6e
SHA1 5ba7c05856ac4d70438106f684d50abff74d7a56
SHA512 ef4875729432055f72a84f53395fce07eadd85bc7e4b0ef846b12968b1ab81bdcb0ce268f4565b079ca3eab9b176a268bb12263b1abb2809869b57eb76d29e64
TLSH
T1A071DD901BC1ADB682768E299A74BC01ED79C6E3532C0145F0AF3B271F37D256B2F254
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSecurity/NetIPsecRule.cmdletDefinition.cdxml

SHA256 b2aa0d6ab7c3f32abe3b7e1332d4647e2460aff27bfa7119b7778d0987ec8510
MD5 ea62132312c0bbd6b6ba0dd1388dac89
SHA1 6f6d0e0158e18393418af45327d69e1d9a27c699
SHA512 ebd15ccaf4a2b3cfc1d00cfad605651bff0af85a2a7fc505cc7e19f7763bb4690a09db98a4157173414489009d1f794c9a160a99d4f051603f85f2539a990740
SSDEEP 384:pk4p8PyWOMwGP3CSrMJovzCWWjGjiGLxFlbSrMJonRlZ+YX:pk4gyWOMwGPySrMQSrMCZx
TLSH
T14403451423CA2ED181B65114AA64ACB2ED7856E3316D0045F2CF3F076F3BDA6F9A3725
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetSecurity.formats.ps1xml

SHA256 4dab9991b29220f23bb86e81a4e0dd6b7ed669459e19ab09bdf658187718f345
MD5 5275eead8fb623b59914c351dd6cc029
SHA1 160beff8d2cfef54458c79d6e0c77b85318dcebd
SHA512 73d543b1105d6041b0b3e93d38a166f7a0678369b5e524619b414cd1207e739f8ce6e18356ec452f000162c09f867b9a82af25bc5a9d59b41ea0012916d33dd3
SSDEEP 768:kbyILyLG2F8FfF1x1f5VuVf97H7Q07H7f9NAUA+ak1WwAwfElEIC97ByiUm4T6pF:8lPKt
TLSH
T160D3D40FA2D42ED619B28119BAAC6765DE14222B4C3E7990F7DC87172FF2C56413363B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetSecurity.psd1

SHA256 a0453bdf93a9294aa558d8c5097832a5196615140ccd908c41f3e9c7602c12c9
MD5 839e7c9a55d4bbc031796f8ccc45d65d
SHA1 3568ad2b017231a3950b08a8a12d44338cba3a00
SHA512 a48d3f0b80729b2442fa49a8fa747c4aedb777010921b2734330c5dcd16b69d4ff5dfb5a2d6ac8b42d5654f160445151eef2f448e3497a85bc89ee7b194865dc
SSDEEP 96:giw7mKqdD2oD2yDo1f+ShkUm8Jx7RMrtpK3eGR7/33RBlhlov0IYLxTtd5YrJNBC:gn
TLSH
T1ACB17957C64D8CB320F89516B0BCE508F5267BAB62B11A2B3B7C188C5FF9D45A1D2B90
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/NetSecurity.types.ps1xml

SHA256 b336b8ad37b10ab78f9363b0617ef627b4ae025187909e4c5d1bbea5b948bcbb
MD5 1c726e3ed985f13a0777cf08cdf88fa4
SHA1 ea2451d79dafea52659545d56f55f4d90dd982ee
SHA512 8d5fc4711a15bb62dbb270bd7733b8a92cc570889a759fb8c67945107c79ab4e2aa9f83af09dcc9a63e238cda82ca6df652cd63c8f517af2b8104d726b3b14b9
SSDEEP 1536:NU+vum1rGKwRoGEOz49U+vumP7YxLG7dEgWaoNQWx/jQGEOz4VU+vum9XRgWaTG0:NU+vum1rGKwRoGEOz49U+vumP7YxLG7i
TLSH
T17C733640DAFCCCA045E8A007AE36F5A9CD21517B403BF195B29C6E877B2C8899797D37
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSecurity/zh-HANS/Microsoft.Windows.Firewall.Commands.Resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d72da2ae1493c5742cffddc185e00cb642bf72e9924f48de9758539d0608b64
MD5 a3eb76a24cc6c23b3a4531da203a1045
SHA1 4f6e34d517ef8b8b17a2ed69a25da175f48081e6
SHA512 ce1c228b33a88b50e950696521bdb89603a2bca937ba9dac7bb931479fd4b0c480a6384ab3a1459078fc3ec760629ded984fc738c6047a86dd3bd5ffc92b1af5
SSDEEP 96:hPpbX3eWj7af7lhxG45CRYCl24x7RnMeFFTpQDdKx0I+D2yWLlW:Zpb3eWKT1GXmCdrh0wyWLlW
TLSH
T13CB14241A3FC0225FDF20BB16CB7DA0566BEB851EC32CB1D489412096CB6A65CE71F36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/NetSwitchTeam/MSFT_NetSwitchTeam.cdxml

SHA256 e671e58a8c5e241f1c9bd6cb1d563bb3db6278dc14f15601b60c78d9ad1ce951
MD5 a99fc2201a4e8cfbab87b84f925589dc
SHA1 8ec1ba8a89a48ba692a993250d55259ae506d359
SHA512 e9e91354e9302e28d90448d320ceccec39a8bfb8e257d4476c8a6f32ddc6353c7451c3bd0630f6e650e03e23fd4be70773eafd5d191c1387c67a0cb546e032a7
SSDEEP 96:mYEJjIKJGXqyzNul+wBWjjfxwpWo6f9wpWvf9Ept:KfIqnFBu6pfsepuept
TLSH
T1CDC1562533C61BC081B55119A691E8B2DE7892D3727C0805B1CF3F075F3BDA6BAA3726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetSwitchTeam/MSFT_NetSwitchTeam.format.ps1xml

SHA256 d408e47789de22336f229e630a5e8b3c345185a11f0396c1ce27b62e0af45498
MD5 2fde9e6e8681ea8a1a7335609d72cd34
SHA1 cd07d5ceaa3b4c9131ef201435de3a2ebcd28f5e
SHA512 e40838c82b909eb208e4ecbcf96bb6f67652707f00c605a239cf46f675dd320c852222a8d5df8b04ac9272875d29d947dc8f150c3e8705b909e4b0eef3643d66
TLSH
T19641EF0BA2E57AD188B1851A7FA88AA5FF207357080F2124F0DC8B071F70D998A33D36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSwitchTeam/MSFT_NetSwitchTeamMember.cdxml

SHA256 11c97107e3de6561140d4533be2fcaf6681c864a88498f9bdc6503e3c39a361f
MD5 2b229f3dcbf22fb3f9255954f564225e
SHA1 4543b0642278b93741715c30785b568ed0890bae
SHA512 c00edac11a6bf5ede09c6eadf07b16cb03ca18b9e933d21d95e589f892b30acfb34999b26326a79e3092e850c6e50fc992508cc96d52d7bc311bffb4fbb26cd8
TLSH
T19B21241463C89ED885B1A108AAB5F8A1EE246AA7D138990AF2DE3B070F37C517443336
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSwitchTeam/MSFT_NetSwitchTeamMember.format.ps1xml

SHA256 40b43037b0da5fac2ac139be644e97d2ebb3552a5180c6e6e0a44c24ccb4bc2e
MD5 6359e83c7f0aae93ec025aa7496141e3
SHA1 f2fb7bfa77bdc47ad715eebf61f9a1e254f29e6c
SHA512 481c2fca0b9f4e633da5d28148744ec670c95cd58ec63631c37c8b256b750ea02fd88c205a2c04f19327d8b39185a9b536e3c422220215532fcffd8e046cfd12
TLSH
T1A961270F63D47EC188B1811A7BAC6A65EE10625B0C2E3564F7DC4B0B1FB2CA94633637
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetSwitchTeam/NetSwitchTeam.psd1

SHA256 2bc6850e50baf53cdb72f4e9beb2cb16b786e792e990f1b7c1df90b6d2b97d16
MD5 d2e2180adfd0728c7a720fcf1d2fd758
SHA1 b7391554f7099f5f3355e6663f1bfc419491ef00
SHA512 657a983007dab77a8cab355444733b6de2677ef90ac2818087caf8bbdaad748ae827f33730cda349250e1fc40364f73a313c7797c418d5b53c7effdc16ff74e9
TLSH
T1ED21AB7C401E08D1D0B7A17368095E8AF7746BB3517DAB0B79BE87840F72E525BC2178
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetCompartment.cdxml

SHA256 2b5bf105fbfe70e8de50b5bbff1f331005c42f77bffcb0b0f91ebbd27ac14ce8
MD5 dda4a533cbb493b47d303812006fb299
SHA1 10bebdca9e60ea36bc5e9929d25b1b90e77dab8a
SHA512 5eb8930b17d34fd412841cfaf885a5148cfefc84033b6505b1ea6350f76019f91ec96560d2f204a1de17f8ae5a44ae1636d2667c4f3e8db1e26a174b88b6aa40
TLSH
T13311B61013C49CEA82B08218A779F854EF90ABA3A23D1406F19E7F130F76C45320B379
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetIPAddress.cdxml

SHA256 b1ef9d2787020392154a761dc2a0bb58d8292e9adf409006f94acbfe6e93e69a
MD5 b8ae1acdddbba3c459ed1da48f5d452a
SHA1 8055682a7fb805acb03b3376cfa4a24c556cdff5
SHA512 d0812f17e0d7023ebbb19a1b9de8a706a17a403481558508ccde0e5075e504ad809b9cffa7831b98546669e823436948084ae755645857bbb8df6bb52a052a82
SSDEEP 96:pYE5gMUyuYlGdXHcVH4otK7LRXYumhBSoCo0cq2AVFnHX3XMo0cq2AVeFnHcdnAn:jAMKMCIxIWKO4eOy+vd
TLSH
T15B92051523C92ED542B11105A1B6F4B9ED289AE3627C0011F2DF6F0B6F3BDA27953727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetIPInterface.cdxml

SHA256 2e2e101eb0eb991798da1236ee27e56854bdbe1f1db20edff4247a5dee49b9ec
MD5 c66ed3cecd5c045e84d48391be72a398
SHA1 4a084e2dde447ce61d6706083aa0767443f14734
SHA512 cdc186835d174efd8f6922fa25db0abacbd3794c8bc7abb134fa100fc5fdf1900bc07bcd23bf5aa200e073ea645d10f4fe511667ae6e8c9fd4f74336891f1746
SSDEEP 96:pYESAv6x6qjuWaZl8Gz/eWvPy6KuSsGIe6MEeuRF+KmxKaOK0GWK9EKU0Rb9GLuR:V1FidlJy1ov1RL
TLSH
T1F1B29C1523C92EEA82B211059576B478ED784AE3227C0019F2CF2B1B2F7FCA17957727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetIPv4Protocol.cdxml

SHA256 6149fa48b4b1e52a39517b9bb7f94ca647e726b610267cede6d664ceb89945bb
MD5 421e1265f0424b133fcb6241809c8d29
SHA1 f5a33e77708c26c299afd3986540cfe836063b99
SHA512 1688191f6fbbea39d982c084661051bd9ea90e96ce340c04f699189068370efc4bcad52df2daa6cceeb35bab26544cc3d857a7a0f8a32af43841bc24d6e31c6c
SSDEEP 96:pYE/HmYJHqFDT8D+AeaJ5DRdBJbxKIDxJd+GJ0YJ3oFZ98vQu0AVFDRJBl39gADz:hY0p/7qulxnt/tJFY8
TLSH
T15B32391423CA2EE942B51218A576B4B9ED2D4BE3727C0118F2CF2B171F7BC917957326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetIPv6Protocol.cdxml

SHA256 1fbb4f288aa0937da2bbea1137ae8cd6e62c586c6a34709dd208cccb6dac7264
MD5 303ccc81743e12552ccb6ef0e09f0a74
SHA1 63ce068a84ef5eb689a0f91d4703c57aa580cf4d
SHA512 e93fe977284c2dc110d666e84e36be97f3147a339158625eb325263ad8491e136f793e788025c85b53d9f36b21da978d8dec288c3ee6f3b95d6e93154242f422
SSDEEP 96:pYE/HmYJHqFDT8Z+WIar3PbxPKWDxnV0oGWZHnfcEOoXGJ0YJ3oFZ985QsKAjXnK:RYwpJJBCqu7BhBr7XbT5Us4
TLSH
T16B62391423CA2EE942B12214A976B4B9ED2D47E3627C0118F2CF2B076F7FD917957326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetNeighbor.cdxml

SHA256 d23762d80b2893d40bcbd54a662a68a3e77f26eb59cd542d08f26445f8673e13
MD5 d551adf77234601f40f7a98adc266bf1
SHA1 572f9b6af3202b39f29dc93f58932392bd9230f1
SHA512 a8037f27cd64400533d4fd4d4b9990e272ab35f61ef566ef674d1d1b6c2fda819520c52dec66d0b640fe50477e78bb0407075b62128d311e33920ed004ac4e91
SSDEEP 96:pYEJgNAJg8emWK71Uz5+No0oFIBGARew0NncNcIiSUj4NNQNcIiSUjU1VZaM7:Dht9v+0i2o4QoyvX
TLSH
T1CB22481023C92ED982B25109A562B4B5ED7896D3727C0455F2CF3F076F7BCA1BA93326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetOffloadGlobalSetting.cdxml

SHA256 8e658f08b149dedea38207efa53bada3375d7ab8bc50521a88a6b920a25a5d8d
MD5 453f2d0f069283c8432d8b23291ffa61
SHA1 3637e592bdf6b11add46d3d145156dbfe4801d97
SHA512 80a7bdecc8699a83758fac2dd92d7ffb2f5e7efa5268c3c0a48bef3d54d649d0bb5e22499188955aaff5ea10eb90de93a94b6292d5a35cfb56539e677a7c7928
SSDEEP 48:c2YEfloxvo8a3o+ofglovmcmv/mKA9mwm9unmoGYyQwVWr0:pYEmxwZY/4e+XvuxMbUmospcA
TLSH
T105B18A0003CA2ED893735108D9B5E9BAED145AE3217D2014F1CF2B0B5F3BC92B597B22
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetPrefixPolicy.cdxml

SHA256 bca8922e63dd4b8ba470a613a40517797e7c770cd57baedbec1ec42426c8fbf2
MD5 a44567cb17a79e2b34115027b9655b84
SHA1 c0a649b5a0a3886229ff5c2f7e1567956a22370f
SHA512 4c40cb5522cb8b9be6d76060372eaacdc29af65b4e4b69b81892feac6f2316df8cf8ed1f899132c77999a813221e9dfc8f3d209df9c85980c8a8dc5ad5a31c75
TLSH
T10F21081013C95ED986B19109D6A6F4B9EE296A97923C5509F3DE2B070F3BC927443337
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetRoute.cdxml

SHA256 153102a950b23c749bda65447dcf3755e0d083557d05ec2dbc1ade7d17836ad1
MD5 e78d12faaa0b2b5037bad51c8a053d23
SHA1 f5a0439d68aeb2508f50110daf82e011e831af4e
SHA512 ef71d785c84db86734bf60fa3a1304cdc749c88e6ac2b814a9032aef4fe0294e5597c1629a746ee227498fc4611f16af638884ff45587f43fc215904fd0e85a9
SSDEEP 96:pYEyANAVT72fFZKanHX8mrK71Rblh8ZO5BAyFIV751ja73nH1cr0ZJmhBSUjbNrC:QMdlkel+WTWkOYLvg
TLSH
T13772061123CA6FD942B21118A562A4B9DD3896D3727C0445F2DF3F076F7BCA1BA93326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetTCPConnection.cdxml

SHA256 7c7960c53b42ab74a2b3346510ef65cfbfcc4b418a980a6b2cebca7a81c203b4
MD5 48ba4bc297fb702e7666a96004d8711d
SHA1 4b31b822f4d4efe1f62665049fd592a00d0b735f
SHA512 7baec31cbc3cfb445eadeda20ed3b7167cb4ec04e8b9d49d5c452bc307cee8e304bcab7e6557652effe729ca4b349281f05b9c02e8e6678455b4546bc3d411df
SSDEEP 48:c2YE8Yy7QbMy7UbVlmHRdLGWDWmu5+pD9hRg0:pYE7gOMgCVlwLLGW0iD9hRh
TLSH
T1E191420817C96EBA83B255149976F478ED285AE7533C0008F2DF2B174F7BC91296B327
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetTCPSetting.cdxml

SHA256 5d9d5e3d158fcca5959231658b56b44896db700b70072ee029a4659b67a6cdb0
MD5 775b31ef8bd9fbc3461707717bffc181
SHA1 4ab7e7629bfb2db0770ee6c2df78b6a67daa4a95
SHA512 7888bd1fd47ca0b07902aacdd4f1b858ef79446c0dfc4e8b76244db47dd2da23da71991266510547e1600b8063f18ef35e588dfc9a4fe5672ab665189e3d74f1
SSDEEP 96:pYEkftKIrQOLrB5v/hlnrXZbyvUEFh5cL3n0Zd5cm13oKmzWdygtSo7Q0vru6Tld:EJUCh4UGFr13wydfzEFUud1yWEB
TLSH
T17A727A1413C92EE983B55115D576B5B9ED388AE3627C0058F2CF2B076F7BC9139A3722
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetTransportFilter.cdxml

SHA256 913634a83b2c4066af38e15d6363baa2aa080f27550d4cfcae8c7a8b53a1202f
MD5 961267417679c9db1633fcded3f7e109
SHA1 aadeeeb4635618f25b2b9c262524d0e6d9782ab6
SHA512 74e9ecad71638fc6af1ef01aa0daf3ea73706864f65b89da32a11aa1e00e00b7746ceb6bc48eeb6f5cf14a58c81af38f18175a22af4a314fc2b42bd970573b51
SSDEEP 96:pYEUg7trzElgBlQQ13+KuayVUy1x4vSdvBge:igB113zyCe
TLSH
T148A1691123CA1ED582B55119E2A2F9B5EE2857E7617C0404B2CF3F0B5F3BC967693326
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetUDPEndpoint.cdxml

SHA256 802bf4d3cd99ddf65ab8966e512476d0e9677f6ab6b6ec2facaeff725ef86240
MD5 267358bd6727625a4255756f80b7cf70
SHA1 a60f8f8da0995c50a986a259c3c2278409a30cf2
SHA512 5f5e9aa4022a8b40aa53a3b9b4d8c024a683474744b2e877422323045256e74a7fc6d91834c01158db181dc21ba20c976d32394e1fd1bc2ff852cb56ca0bf289
TLSH
T1ED31580013C95ED946B59008E5B6F4B9EE685AA7913C4508F3CE6F0B1F37C953443327
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetTCPIP/MSFT_NetUDPSetting.cdxml

SHA256 ceb2b35340ddbcaedec3a17786b7e3b7dbf5865d46c2abd3c71f0f1df8916942
MD5 7d129c78847d0ce437a8364b44c2ad4c
SHA1 17f2e8cc2a2304d634a2fac4265562ab26a13931
SHA512 9ff39decafa81fc698ecd42e053a46934b53c18bd2f3f7fdaad9ceeb73a0369721a0090318c6108025bbbc5fbf5b3f98f2e07026034134d092a95d9741feb853
TLSH
T1C5316B1013C55ADA42B5901CD556F8B6DE2896D7B17C4409B3CF2F075F3BC52798332A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetTCPIP/NetIPConfiguration.psm1

SHA256 0c1d9e5342da99c4cdbcf5a698cb17d17fa23217bdd1755565e5a83f134c0b9d
MD5 099f256ab89a8065a3958128447dcd44
SHA1 605fd37661c7bc14d39f4160a08298f9f5faac1c
SHA512 08a52d271546d857c398f63c47d7a0bdaeca6ef9291183e475f8327716996b6b1be40bb92e43f7eee6bbccc86ad85aebe4f1f36e1b92ce6e3a11a418bc8a89d3
SSDEEP 192:Sp4bUr46toDLGL6jpD2h5IHWxRgWKN7LB:Sp4AroDLGL2DKnITLB
TLSH
T1F0620134A61BB03544736216E7869C28DFD96BEB51EE000A728CC6493F7BED49398F4D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/NetTCPIP.psd1

SHA256 ec0d8945a1e0d2bc4c243ca6cb919ac6bc681996023404436358f9b1d6d9960d
MD5 3490a9f41ce216723d165d32e1d574a7
SHA1 0b612f9ee0afc936c24d1899c209636cd68fb1db
SHA512 bbb4c2ad71c8d6f5fac0b719cd8e63a86aada43cdba5095da0fdfe7bcdf4d1f66628e1dce1bd83f953000718a77f2ca9898e007c6822a306dd7d66941a9227e1
TLSH
T122412454D0051CB6548E2266B9C1F60D71AD2AB35DED322D3FAC860C0F5DEAF46F2A4D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetTCPIP/Tcpip.Format.ps1xml

SHA256 a30ccd440b1811a0ea4f7c19f698bb5fa1f3ace2e6e52af704d4ced53089f064
MD5 1f8422df5c000236d0692210db17b4fa
SHA1 7e2b29a7bb40c399c55d4e86b68f755799c00a11
SHA512 597eab0e62b4ad5c946ad412daec9348db8e375cf6ff8f894436752919629dfb5fc2a563df99c4fd3a9c41200d27d548791a2363b441289e561743474a8e45d6
SSDEEP 768:4XvLYL5LhLSzyLnLxDLnLTGLpLILJLwcfvZD:iLYL5LhL5LnLhLnLCLpLILJLwcfvZD
TLSH
T15873090BA3D47ED559B6801ABBE8B264DE14120B483F2554F39C9B076FF6CA54133A3B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/Tcpip.Types.ps1xml

SHA256 8a4a95f19d0b76b75c965210ea9e295279832672ed9375f42eb28970dbbae624
MD5 bc64b61b72275c5ddbb71cf5c6efa47b
SHA1 9eb8cc82156da27b251f598795eb60ebd3e94537
SHA512 78fefec833dd7cfe35d4a4c41b92e6ede6e5e31631a9c67bc44df912f8d1668557a860491516a9ec5b60e35f9f2e4fb67344a4f95226b443431d3fcd62b373e4
SSDEEP 768:3Znr5ppICD5gJtAVFRrYyr3cRCCF/94b/Hr92CVE4uV6dgC+OhIUe5uVcrsBJGq1:3Znr5ppICD5gJtAVFRrYyr3cRCCF/94l
TLSH
T172238B60EABCC8E085E9104BEE76F865CD21026B803BF1A5725C9F837B2D485D797D36
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetTCPIP/Test-NetConnection.psm1

SHA256 b8e5e9d58fd321138f0dfa9f6a7adfa3787cfba1c17a89d20db3958de47832e0
MD5 1ebb8847db2d858ff49324d7769f92bd
SHA1 4ce47e692d5f931fdab5f902dce067abec15ad41
SHA512 76c0777ff6d5cf90793f9c3fdcdfc4480dff32b668042b850d74e19bc0b9305257a475f0182bf35f5456ecf73da40837a26413dc57b9883e35ca60c2dfcdda33
SSDEEP 192:qHcxk7gtVinb8TknkMDOL0R2Jgnv/dNef7zeZhwTbKTnL0AUpFquUj8vNkEO/6wR:gcxhLuFJvVNoeZqtAY0uagN7OysJxR
TLSH
T166C243207703B2581833239AFD86D418DF7A04A7519F1428FEACC5845F79A71EB76B8E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkConnectivityStatus/MSFT_DAConnectionStatus.cdxml

SHA256 4716f0c1edc87c5e936bec7a858a81ce307ffe670dded714504279266e8bedd6
MD5 0eb8a6711e101f00a98bf70694ca422c
SHA1 967bc9a9c2e572f3218074df79008ac673e26976
SHA512 65cdf11fd3e7d05e1fa27553983462ca9f545a47d658152645c8af20ae760ab7a1662330d09c0583c29295d8b7a6aa859b76121096bf92c0c8cc14a17d9e6aed
TLSH
T1354116285FEDEC7381730A215931A800DF7684A3730E049DB02D75667FBE54D5A2F2A5
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkConnectivityStatus/MSFT_DAConnectionStatus.format.ps1xml

SHA256 9714b7b1890400fc73a2d37e67cb0579fc6daf701e9a622fc16d2e5f9f406f0a
MD5 9c13c8c9eaa0b2d9b1979e7390c03169
SHA1 3629f18f927936fe348882d4e792aa3d4e779044
SHA512 9cb006fd1fd209f2c1ebc0e13180832193a5638acefda375a6ee568b65f4d9921520b9e37ed7fd55836937af3f8bcf453821a5e452260ee1e6c937770442b1f4
TLSH
T1EA01B50AF7242761B8A1412BBA755AA0EE347F8F64AE1044F0AC5A3777911F9413357E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkConnectivityStatus/MSFT_DAConnectionStatus.types.ps1xml

SHA256 a388859fa814b36cc0b8524e1254a08851ceab3b7d4db5521422d6b640e7e4ae
MD5 e5c2c10b7d03453f4a8457f76ac626c1
SHA1 d317e4cfe08df7ff2645f2621fb02e001c239ae5
SHA512 96f43ef3ea5b847b593728395095e2d72c39626f73da40a801b991ceb1f777bf17b63fc3bcca9a3839d5040b7901db1620d40d237d505f5a401e0ceb1493dbf9
TLSH
T16011C850E6FCC8A08AA410079B36F469CD11156B503BA5A5729C9B93BF3C4C4DBA7C7B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkConnectivityStatus/MSFT_NCSIPolicyConfiguration.cdxml

SHA256 bcbda5b2edd5cac40cabcc5b80f8d0f195b479a7b6991d0c68c4da3805e8e07e
MD5 31f5d002d3a7a371cbadd629baba7da0
SHA1 a758c819c48816e11b5ed20684232b18855dd545
SHA512 1f95c3886e94428efd8690f9834d29ddc6e9055d2852082f7747a490d5d29f71b49b0cf05228811c03f93844272a7a85e94a0eca41d2948f68f53f158868c118
SSDEEP 48:c2Y0wYVq0e0TmslRn9eCn+D8ukdRnnirrn51OmklhkSjdZ3Dzl4:pY0bdCwt9V+DWjnir75XYhTjdZ3De
TLSH
T103A1F111334E17D982A2116B25B294B18D7DDAD3716C0485B0CF3E27773FDA5BA63728
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkConnectivityStatus/MSFT_NCSIPolicyConfiguration.format.ps1xml

SHA256 7e7208229d3a968c19ff2e16450f2022cf757571d651cca895541d1e44af7ba0
MD5 fc79e456a067226ffe6c6518db9f757e
SHA1 b17bcafad51680f33a25fdefcca581aecceaabb9
SHA512 04678c3882734cd9481995432776981c06fa0764bfa02dc23f572f7e9132217ef8a74c21c84d86722a7bab4a2e0a87da6febfb61c185ff79f9fa9ba2f445da82
TLSH
T1C2214F4BB7546A9178E5411B7AF876A0FE386F4B88790004F2AD6B3773D65B4023323A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkConnectivityStatus/NetworkConnectivityStatus.psd1

SHA256 8357a5e2061efe94dfef4838dbdef5f6fef0fef3699e39e0b99653942656a3b9
MD5 028178f5c35248e2277d440f82423589
SHA1 9908ac9a43d775684b8e3d717d1ad95df7c37177
SHA512 679ef97822fc85573814f06264cfcf6381fa3f44538a1fb69d76a78bbce6776d2ec50211f0ca2d82a3a48d3d4f1e33792772bab17592e80805222669381cfba2
TLSH
T13D11C0A1901C9207E43B6267F1CD0D08FF7C7B5371198859B53D87840F76D90936A7C9
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/CmdletHelpers.psm1

SHA256 c401a74d86f136decdb4d028338253eb7feb6707693fa88f951af711bb0eeca3
MD5 4ef847af5b09af2822f628df59427b54
SHA1 02709246dfbecad0f680bc99e6c37fd4af7f7dde
SHA512 84e36c023c17b5e745c7f5c5184a6abaccb9e583594425932fe1f72f47fe1e465bd1d77b1b91bb97793d401d2915c505e75ca3f4c693f74144f154b8347e440f
SSDEEP 384:duilLLP/r7NkBHtbF0+H9PLX3fu3xZX3o/cX1xi5zDmp:wilLLHr7NkBHT/0i5za
TLSH
T1E0625428270181E607F193E96CAAA515F73431AB9DAF23067AFCC1D53F32104DBA694F
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchConfiguration.psm1

SHA256 c13a79f9947212d8eb2c4b4d3bc673a7f27d0f7f948e8f43163d8785bc5372f0
MD5 d5c1f07addee99d3f9938088ac6add92
SHA1 d05776d40d42acf3103cef343f9cb4931823a836
SHA512 5c6081288a97e63ee7692cfaabdf7ab03a0b796d02d4997b498259f11c4a5ad89c9f71f1536776a8e72ecff9bc3425b46af2a8f25b0e41e35863294525236169
TLSH
T11E519B281705916C47F6E33A8CDA6669EA70226B7DBF051BFCED53A03F38214A756409
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchEthernetPort.psm1

SHA256 17e7840a49011b17f5f8ba6eae0fb907084a6345d056e864c8c77e5172d11d52
MD5 4224e1f89f01d59a5e9230657f8e4121
SHA1 e4991a0284575fd0a70c7e57a292262bf4bf3d43
SHA512 fc87e8e28bb326e8d617a32cefabb928e48fee29af94546297b76b85fb09b5c99fafb2df2c42a32eebd6676d545b6a3fa898419cdab9eab0d6a15c4b742c38a4
SSDEEP 192:v/MAU+YJAh+C28Zl/LmT0DAhqiIRgAbXwX1UPAhwS6OvBTJWS6lVtQC6TvBT3Axm:HmSs0yUhqWS6lK0f2Ori
TLSH
T192B2FE38131252E445FDA33C9DE6641AFA3D2153BCFE2226BDEC42E43F35805AB95A4D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchFeature.psm1

SHA256 4a38b11198a87f72f71e54364d0058d246203f46e795de15418720c2ad848d9d
MD5 76b744c2250689081919193404427ed9
SHA1 e28a9501711bd1c9d4fac1ab719765ab0b93dc2c
SHA512 905ffdb5abc5440c2bd2256691870e414456f25c75e21e5f2890245c925e94f297d245cd54a1369f9511ee189c11dcb7e379e8cb66b6d48d6ba3e8900373c25a
SSDEEP 48:vUKZDPr/BKaHTYUWkcs2/OWquj+2lRdeyo+Ph2oyo+HX1Dayo+giDzvRXu2Qd0a3:vUKZDvHTzBL0KSPss3dGBL0KSPs3MhI0
TLSH
T12312CC2C431281544BBA9339A9A5285EFD3E21E3DDBF1125FDEC51A03FF1805A79CA4E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchGlobalSettingData.psm1

SHA256 22a5811db8a92e07b09f8f0c90e9dda757c1beb997baea166904fed911595f1f
MD5 6286aaf9c13aeaf513cd64fe9576ee32
SHA1 d1ef0ff6989bb8462a85c3c5b7a634645280e7f7
SHA512 00ff347abf38a7f66cbf11a1309adcaf5e36bffceb77f9030beeb4b1167ac716f5ef2793bf4e42dfa4c216fa046381121b627d9e2d50a6b27c510a0bbea76303
TLSH
T16731D02C1314802C4BF1A33A98DEAA99F23931976DFF065AB49D95503B32354A78214E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchManager.format.ps1xml

SHA256 39c7c6a50ff1eb1ae461abfcc67112f579154b6cafc8fda98a989738d15dc56f
MD5 536ecc722c7878b98531ea80d6b16bf6
SHA1 eb31d1bf6bc905d452498476976d748f7719485d
SHA512 f0d6c3677a9ac6a4800ef0eb947ac6e3146d408512b12036665dedf250f8d613a248906094b3f78db08d255f8643bd42c22aded16bd173a4c1f2d90c8c111317
SSDEEP 48:0DYRfe6MjRo2DvOud1J/J8rpomMkvSWnlJveW8P:0DC2FRdDGuFJ8rphlf/eW8P
TLSH
T13272A30FA3D03AD519B6C51ABBAC6669DD11620B0C7E3960F79C470B2FB2D654233A37
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchManager.psd1

SHA256 1209c88ba75edf42e37e48569858990c615d7f58efa8b8626202a84b244d369b
MD5 84e17c9b6443c92e9c6eed56c8717282
SHA1 cde6a1c0b1399f881376845c88c29a88d4ea0b90
SHA512 4e6a2512bd9e4b46dd9cdedab7b92b379357198175f34713efd95497abd6b846dd99a05ae9f30e14eae933646277dcd786ee89ac9102a8b789b4936cef51b3aa
TLSH
T1EF411435421A18168376E213AA85BA4AE6080B731CFF01FF7D7E67480FF7A858F89171
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchManager.types.ps1xml

SHA256 6121307644f65eb1a92a326b3aad97f5d74145e8799443530b256245df86d754
MD5 69581ae1ed5b251e42e586e1c9a00dd5
SHA1 6c65465da585dbf5e60b7486bd1cf4d3bf430be7
SHA512 49e874a31ef232dc0767c5a393cf98f563051740239783195999a7482cce956361801a39a26b2d232cdd8f2bd132eb792c6c054dae70c4390606033bd64d5901
TLSH
T13821F307B2ED948105F410637D126A16FE2AC19B05BD01A9F2CE07BF6F70DDA9663A36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/NetworkSwitchVlan.psm1

SHA256 30270aea789f660d9d5d15a28dc63f0e9f7f0eca786bfec6392c4bfb5f380aa5
MD5 d02fe407a3a2bacbe694878a74567a64
SHA1 76d3ca2f8787ca3fcc107f908ca847ec01f4f3d4
SHA512 6e868a22aa622c660c4ca142c9ad03cebebd9932a1d047c0bc5fbe425966b2aa3469692445369e53bb8a7773bda1832b1857ef1d8ab81435ef01bd930b10f242
SSDEEP 96:vCZDaeDV/KemV/RVmcPUFfL2gotpqUJ4+3OErZ8H7jgx6SyV:v6Dddmd7sZBot4YNF18bj3Sg
TLSH
T181821238470252A845FAA3389EF6741BFA392253DDFF1125FDEC01A07F35845AB9990E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkSwitchManager/zh-CN/NetworkSwitchManager.Resource.psd1

SHA256 213583ceb210143a912392c33b576f6f22ee412d99b04af38c6f59212047de81
MD5 55f6009f127e00ddc8347f54eea7c797
SHA1 1facca4448c607b93142d61a3c6beb6a91d4801c
SHA512 e4c628d86e6ab72d7494ab7b3c6f7ed8cb7e6c9dc300cf6560edffac881b605bf64c019c71430c5e7482820d7e6bc0c9140153262dfe8f6a56d952cc80e17d9b
TLSH
T1CF515B8167E82058B7FA6F4047F62D308FB3F9158E36889D25AC415A07FF980EA35357
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_Net6to4Configuration.cdxml

SHA256 4683adcafc0abbcba69d393383653828ff5f0f77d935a522e9f00073df669722
MD5 95f25e968578cc68a2a19d51c4127a9d
SHA1 049da61f24db98486addb17bd2b7e3424783654d
SHA512 e8731b89a16d4bb14cff9c39ddf37ce326e51ad0327213c850ac41b2db78ecf7a7ebfe186f6a5c2365dd42ce6a53c3c1b9974d235deb7a66b315e9bd52db3473
SSDEEP 96:pY0GhgKsOtrmu98s+D8jCj6i8F48lbnLU3tMbbP:m9F8nD82L8e8Pz
TLSH
T146C13321338E1AD982A2121B653198719D7D9BD3315D0448B0CF3E37773FDA6B693729
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_Net6to4Configuration.format.ps1xml

SHA256 b6e1570e9a1965d98f563fb88171d0ec7985ab95b55ec0135fda465d3fef62f9
MD5 8db31070bd28ce01ddeb19c1d3ac0b5e
SHA1 dcfa80945311c38f2b5bb0a6e7ea85b5041d56db
SHA512 c59350f27212c51bb60ea3e2586556d188cf9971a7d34c0d322f105b0e64d63cee264495d2f897e680c8d62c71429e54f1316bdf38231cf868b9ca62e489f899
TLSH
T1E921630BB3542E917CE2421B79B866A0FE302F4B887E0004F6AC5A7733955F4457323A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_Net6to4Configuration.types.ps1xml

SHA256 78582df9eef3d4e39b13b27474e0701a98f22cb28dea105a529b433af06f566c
MD5 4dd22842805cb326d63a6a74dd5dbe6a
SHA1 18880f9db858f239e11667416c6be90e1cf4ce39
SHA512 efbaef989de5fee0279e4239bacd6b42e9cfbad2bafaef69569b0f6b4e7322793811fa02b991756115910ae4f3b8e26032a082b1b9b5696993598cc1382f11ac
TLSH
T19251DA50E5FCC8A089E95007DE3AF85ACD20117B403FE599715CAB87BB2C885DB97836
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetDnsTransitionConfiguration.cdxml

SHA256 ffda890cce00da546894a1c9843637e8542d22c8123d3b9163d4de007f23a3fb
MD5 dc2b2c176c8e88b4b9af68f7cc40cf04
SHA1 e006f45ecfd351fa7b2a5db9681b1387bbb0c1a7
SHA512 0c8f80ab8a435e30ff9071808b56f94038b60bd14d974affae2297ecee32f7bd7af4dfe26a2d6c704dbc0a41cbd7a1fbe42aa7141a579f5bbda401f641f53eb8
SSDEEP 48:c2YGsYJBM7wsoKynus8rm9t8OmBt8Im0IA4Ct8OmgXduyXuhfu3ufxx6g0:pYGNguKUwK9OxBOH1uOxocP6h
TLSH
T1C3E1032123CA1BE541B24129666598B1ED7947E3714D0588B0CF3E17AF3FEB2FA93724
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetDnsTransitionConfiguration.format.ps1xml

SHA256 c7f1acfc304302d1e04cb66523ee984efedce926e1734984c6d4972485d28d2b
MD5 8d2d7cfa363e44b028fde76afaa7bb41
SHA1 61d90427c8d8baefd4fcde815ece563f8266b8d7
SHA512 66ed208a91d7e27c32e5efcfa6cefb21e61e2c135bae164e2eb0e2453e2aaceac9ac0f7fb0abd10b5292284a8cc90d8826cc45b9bb4ad8adb43b569bd5481212
TLSH
T106313E4FA6D52E516CF18219BAE8A660EE20674B8C790014F2AD4B073FF28F4057363A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetDnsTransitionConfiguration.types.ps1xml

SHA256 74a665ea7c4c30c7f0a0d85d92057d5ba8e699cfc59e0e55665c7ff9a6600239
MD5 63b63f26e056d7f976ebf08214c6009e
SHA1 efd922f7a2ed0052a960cd3eb8be60e3efd4b8c4
SHA512 9e064c01c2cf4bbeac65213e0d2e4fe3f060c3a97b4398d781750cf11c1acbe0a4fda14f830fb924660a563ff6142d29625fadda02dcf24bc4e5c46319e1bf1b
TLSH
T130212951B3FC88A088B45003DB69F856DE301167407FA59D719C9A43BF2C8899B97E2A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetDnsTransitionMonitoring.cdxml

SHA256 ab53312b6b33ea6335130de0780db8a89552afee484c4c7fd416365f6a0b6148
MD5 3d11c60532ea08e56c55aeb475ee683d
SHA1 1c0d6d3befd3210819122ec0352ef1fb5f017b2d
SHA512 af142051804b01b652453651cdcb0c539768cada72baefb2e67c24ecac690d3840e60b48f1e5f8f647f0a24e88bd2a448923568860ef11751371fee1afb800bf
TLSH
T157F0ED00D3C189C24A77E22C87D1DC41F3B036ABD128AD8CB59D9E031FB784AA5873A8
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetDnsTransitionMonitoring.format.ps1xml

SHA256 6be44ddf36bee4abc6e43fe4c99521869363997929f47942fb4a7c4ffcebbbfb
MD5 b478f0702a701596a3462fd7b3712a20
SHA1 66c14131d4b2900debfd78c7ad1e277f8db0f8a5
SHA512 a49529bc3c5817f0aeaede25f7ad0df58986c2d69315955963d11aecc51a23ec37f51848308df76acfffa3e6e14b1fb7d8d4d6dc3971663bc5b53ea1ef5159f3
TLSH
T15A313D0AE2C52A816CF14119BF98A671FE61630B887A0014F3AD0B5B6FF2CA5163323D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetISATAPConfiguration.cdxml

SHA256 c7ff7163d74d19aecc7805e9ff002d765e9f15b0bd0d8a175147877e935040c1
MD5 f5b2da84d06c14ff01e36f2601f5ae15
SHA1 82faa178d9a7210bccf61765a29b962f0e92c31a
SHA512 ad734522c535469f1b234a5f851dccb7e8d21db7d0bb207e8991bf1170a1938988d18a20a58166aff3415579b537072c3eca7d0d79df20177c3862372ec82985
SSDEEP 96:pY0I+gKsOndxf98b3+Dgj8F/8lbTb8bqmebG:omh8buDY8F8xdC
TLSH
T123B14311338E1AD982A2122B253598648DBD9BD3325D0448B0CF3E37773FDA6BA97719
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetISATAPConfiguration.format.ps1xml

SHA256 68518201a8c57a006bd44f79f1eafb3e26ed1d19a7a7d463814ee58b6bed78d9
MD5 f26a0730b98bdf1cf349e121ba95cc1f
SHA1 0f33eaa4667d7bb71acd6483e3c4ba7516c0fb4e
SHA512 6155d14991a93e5e2695abcc9814d708a41e2b42423c0abeb612ed3056b43d5bfd3d538cc190e9c0b9989a1019e92cb9cd31c38376f5f69f420460d5a5fc5dc0
TLSH
T147217F0BB7542A917DE1422B7EB866A0FE702F4B48BA0004F6AC5B3733965F4153323E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetISATAPConfiguration.types.ps1xml

SHA256 aefab556919e34955b6214db4112b31c29ab82b48605ef3813e5c1b7937ddd35
MD5 75fffe8f0819878473b18b2e582f3536
SHA1 1b62c8e3bb63a975a7a52c0213993ce776a4c22e
SHA512 0eeff638842104c62d7b53d0079853cfd5c8f77e14046c0191085372cb985362d44e0846f35ca16c5444d61e2a7908dc9f34be6944d4a14ed18d654aa3482177
TLSH
T137412C51E5FCC8A089E550139F3AF859CE201167403FA599725C9B83BB2CC84E79BD3B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetIpHTTPsConfiguration.cdxml

SHA256 ed1ccad3c548728d2eb58065f0469e8b8d22e04f8be57013016180777fcfcfd6
MD5 1d974cc9492fcdc509a6ae8148bfb7a7
SHA1 611d78673201a145ba3a774140ce5e610bd9cde4
SHA512 b3b1498e3e8fe67badfc46eb259ba205eaa5913b442fb8c45fac14ae38be9a01e0caebd17e332ed300475b7174987341ae132f5c08cdcdd3907ecb113bb18422
SSDEEP 96:pYGLafGoGuTufxj1TYpPOxUzYOrSC3NAu49f3NAu0xoK/q3ZFx6x/9ObcRE3uFs4:YO3fff4xNC9NKm9o5o4RE+iV2
TLSH
T17862332123CA5FE681B25128A565E871DD3A87E3716C0485B1CF3F076F3BDA1BAA3714
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetIpHTTPsConfiguration.format.ps1xml

SHA256 87edc09a33c0f6cfb801b426201bd977ebfc8ea55e0ccc65bf37c9d0b4e22f80
MD5 3a57a3f729f00e0a01e434ed5240d5c3
SHA1 cbfa46718d2adf67962552d3fb2db25cc282926f
SHA512 a019243d881fd15427c72dbc3f43da2741cb2392af218df874c25625d102999eb2b91d8e2c6609a277f66658073c9221a1e1493fe0077002db892974603b429f
TLSH
T182413E4FE2D16E912CF14129BAA8A664EE11634B88790004F3AD1B173FF6CB4057323E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetIpHTTPsConfiguration.types.ps1xml

SHA256 d67f848f9adc70856bfb03769bf15457c1f68d8ac5d9dd574a43e47bf46d194d
MD5 9737fec8788c0b4af061d16fe72d938e
SHA1 c144f8b4253b999c1e9f7fe72e1ffd1d34e6998e
SHA512 486f80bf2558584a1e6c64b8401bf69829c7b0242766d207822709e48c394a1b4c9ca92c2009384efb8c52c3f5569ab6bf6fe7d91efbbb81c89f56b7a53c76d1
TLSH
T10981D661E6F8CCA085A54017DA76F85DCD21126B803FF1A9725CAEC37B2C8849B97D36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetIpHTTPsState.cdxml

SHA256 9fb50d68e5be3c35259c446f8500c2b1bac39217a9f075af4585a2310d2598e8
MD5 6f940f63fc4ccb8264992b51f792ab0d
SHA1 45def8623e05ff23592634cc1022289cba80725a
SHA512 79aadf9ee5e7b3eaf3846266139749afe9599f69c582bbeb59b2904b7332506c1ea725c1ceb657a6653b6d99df891fd139f74051239bd7697beb413cf2ad6687
TLSH
T1A3E06810B3C096C28976E11C879DDC08E753339FC0186999B59D9F430F7684AB04B37C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetIpHTTPsState.format.ps1xml

SHA256 50564e130102f13f23fd7bee83cc65aa8a856138f1fb09fa2431e14e93613ac1
MD5 30882f357e96102230e36f61be83047b
SHA1 7a7bf48e3af1bafa5af06a3c055b84c016d6c494
SHA512 5aec2a3ec229a98cf86c2750a0f2c6f8eac3d7ae1348ccc762c7d2a4eb2606ba94ae5a12a4b32ac8ae59e4e8fc97d1a45612b58c4e1691ce8b22e6f5b6b7dca2
TLSH
T1BA11D64AF1D12A516CF08129BF589AA4EE21734F486B0064F2AD0F5B7FB1CF50523239
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetNatTransitionConfiguration.cdxml

SHA256 bd627bc27e25ae36aa23496556599f49176eb22688e609882be1cceb4c2f5766
MD5 cf77fa59129ac6a833ea35869368c756
SHA1 b5e0022b0334d0cf3e43a7c2adf6c5f1617682e1
SHA512 c83559698efd878604716c78b8709838ff369a186f0bb14684629682f450dc4c58a2ad95d0f0150944b231d3138e0a1cfabab3b298b92075976f2c23fc4c5649
SSDEEP 96:pYGWF3QuKUwKIGx9OxBOxO27DGR6I1hwps:6gMe6ERfhAs
TLSH
T1C0F1672123C65FE141B65129AA64AC71DD7887E3716D0488B0CF3F076F3BDA5BA93728
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetNatTransitionConfiguration.format.ps1xml

SHA256 4ac1c12d379a5f723eee7759f1d6a08a56d84335a2fa3be6234cf37e74370dc9
MD5 58bbdd056e21b1cc637f0ddac57f5890
SHA1 0d0766e911d1f4d0faca99348aefe52a1276ce86
SHA512 df4f66fbb510977c1d6e28da240b39621cff9853f59d73506eaa26e91699a7ed0bef2d9199fd7f484b0426251c620e751ccf5c5c6bba50cce2f3ef284f37e140
TLSH
T19231244BA6D16E916CF54119BAE8B660EE20674B8C790008F2AD0B073FF68F5017363A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetNatTransitionConfiguration.types.ps1xml

SHA256 2b6a1c46f49c826acfce44f35e727194d7283c199a80ed0ccea834d0be3d72c2
MD5 aa5e11c429a46809b76a5ded83ac3093
SHA1 29eefcadf6fc39f1b3ae8ec62e3ceb8ff0fec50a
SHA512 0aea136920d5441adb75c3765344ff15c0d167a67bc9d4164d0014c3b58f4afcd4d73fa3b430f2d5bbc66f6fb4dd45d9d70afcaee6c74acfa7f0fa82473cb443
TLSH
T1A4414611E6FCC8F088B950079B6AF95ACD21117B403BE1AD715C9B837B2C8449B97C2A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetNatTransitionMonitoring.cdxml

SHA256 178d65f671b5b271ba70cf4efb1ae6f5ad9d79f3f5434f5178e1a100f0a93f61
MD5 466867507654388444c13edc3efb9e22
SHA1 b596540078abb1db56989cf706c5f09b1265c145
SHA512 af5dde82ff439be6b5650c7d9c33ddc301bf2e8521c130fe47decdea5de825851e8581ab4acee2a608d93c330b2b6d09bc4a6abf2c386bfade1121dc28d48be0
TLSH
T11211680083C15ADA42B2E20CC3A5E861FB642A97E139550DF2CD6F070F77C567143379
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetNatTransitionMonitoring.format.ps1xml

SHA256 a69f31bbb5e9ea7ce5282242469fbea9139a734fcc8bcc35fc1fff3fbe49e70c
MD5 b5155b207e89c835ef8bd0f8012e5e6c
SHA1 74beeaa077b56a133c6825c7f05aa2eef53bc2bd
SHA512 5d7d6d48b123ba2298c103b7bdbe6ace5f1106818c49877a8c5069e8595c0f0fb897a118b860288711283c9ac3cc4e218b954021dbea49d876848d9e909a36e0
TLSH
T11941F70B43C07AC64532C51997FC5629ED3161670C2F7968F78C830B1FB1C1A8633A3A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetTeredoConfiguration.cdxml

SHA256 e1708797a38e4ce716e1f4a4d667f883acdb36c6609d3a4a8638c02a133dce81
MD5 9e6c6afc8040b65a60089f38a1b17975
SHA1 8a9bb58e4bf1eb823e9e2008110bb4f789d1413b
SHA512 b786e81e183f24b4c611977c40f541443edc9e4bac1a12fb71c66028a3ef1409f2aa8c5b91c05e780d4e374c5757b78552c31718e7663c8cd040e44363d4f9b1
SSDEEP 96:pY0b/gKsOhrMTpW98U+DMG8Mi8V51A8Yf8lLOmDhh3vDbb7:7/cS8PDF858jG808RJ/
TLSH
T17BE12411338E2BE98292122B257194B58D7D9AD3715D0488B0CF3E37B73FDA5BA63724
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetTeredoConfiguration.format.ps1xml

SHA256 cb764e38cf4e88cd645fd6e09ced711c08cc68677bb2273896556b48c6e884be
MD5 3782ab91763095a55f3e92a1ca11284c
SHA1 10fe3f90226d3dfd8e17d58ef15302fa69c5a42c
SHA512 eedc35d5c06ced371deabe5b701667b56c1e6963c00f6faa1eb497378f9edcfaade06a0214790bcadfd165e5ab1ce59b49d2fc4bea0be01ef0a74da5dd9d54c1
TLSH
T127310C0EB7552E957CE1421B7AB876A0FE306F4B88B90004F2AC5A3737D64F4057323A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetTeredoConfiguration.types.ps1xml

SHA256 6dd77198ea247f41c3a398c3a288ad249a27d7ab741d965eb4e0eacd21858899
MD5 316d3651334ab54eca653e76dc433ac8
SHA1 2423c13108c7050fe71239106ff42305d9415686
SHA512 d5e3c0c1c9a80a7fae4a63594895e5d9519cc3f8a4dc775f7833cf92ae724a696f4c62ca2e5adc1e9b3289428a49f30ea75b523ab40fa40c0d8be755a2ea7c1d
TLSH
T18C213010B6FCC8A149B44103EB35F859DD10526F403FF199719CAE836F2C8889BC3A36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetTeredoState.cdxml

SHA256 8bb1bb563a5f72c5ca7179f44013e5cb69ed5065bc224b920155a3511dae514c
MD5 fa24a7cee95c2f31ef1c32de78472253
SHA1 910f7b0e1d343cc9f2324d34374dc1c2a3e1459f
SHA512 8636ea6db45d94be0fa952f29bdd1483c93a01c6ca253e1bff0a925db8cb6b02e127cb62b01ce4ca0a79f57aabc80a2c283d5397c166d0afe6b3e339213ac305
TLSH
T1F5F0E900638886C58533E24D5AB5E840E3653A8BE02A6849B195AE473FBAC5EB40B36C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/MSFT_NetTeredoState.format.ps1xml

SHA256 9c8abd638cdf9a65517a1aba1d6344ab0ce7c1b56d1e9ab737a636f3cfce272b
MD5 0d9e9a7eb05804113509709fbe7fae32
SHA1 c15a2b5b301f5f250a98aef299288e9982787fb5
SHA512 6cf9917936b9a3d391a8310b1a4c04ede7bf16f589f12cf4759c89dd7e296e8f1dec2d8b3d428318bc85a3e00e3ad9195edee880602411875cf90c3482481fd0
TLSH
T19D01C206F23C3A39A8D1866B75B879B0615FFFFD587A0065B1743A7B71830E9052123E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/NetworkTransition/NetworkTransition.psd1

SHA256 259c168ac01951031585b581dc232647c693fee0032a0bcc51fe9588f37dd0aa
MD5 df3a41a127dc578e29e0f60861700740
SHA1 08de149887e98fea444c4acb8793fe038c4a54f2
SHA512 c78f5d9d42622e13039515acb84edb31201a689c814daa23aced99555dc6b1b59e9145972e406be3c8e825e9401def316df92383fcf58af542beb6d9001c4f3b
TLSH
T1955136D2C2814C57C423B3A3F1C9A44A3D762B7A317C4C6DBCBE68451BAED741603B99
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PKI/pki.psd1

SHA256 09077491dce2b810cf09a6ad865527fb02ca92126c7eec125ed157644999b74e
MD5 e70d9b5778f326a57549a2e780087e53
SHA1 de290370466ba6211b96c7f5ffa89129ec56fc33
SHA512 a9d75eaba6e611026bf7cc1d8c60011dbdde84fd56d6110b1165bf74e26e8d5c77859e60223ffccfa237307c931c6f38bb33f604da6f60746da753bbc0e44ec8
TLSH
T130415C02A7FD8F15F8F21BA199B978644937BF2C9E28CD1E2051864D18B0E0549B1BB7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PKI/pki.types.ps1xml

SHA256 b6001755a4ead389822fb45c10207405dd471a7edeae914830c96f9fb33434d8
MD5 47eab376ab1b4bd686c8ea0a7cd06c05
SHA1 10a0c84434ba253b13855ab049ca3b3851d73116
SHA512 32a23b8392c4eda7f30a642d36fa651af1203dde48e9a30445c153a1d528460843b2f0b52f2bb1bd80f9a576af630b4fc1662a2f30b37f1eba86a7d8aeb5c0d3
SSDEEP 384:+Bt+XNgCXNkNKX5HoarGvwplLN8GR2x2zfce8caRanKxGt:+ezjHvrhlp822Ufu74nj
TLSH
T1274227AC5F247D3E11069932F8693A280B3EDD82F6EE21F4B51CA41FBFA051D46424ED
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCClassResources/WindowsPackageCab/WindowsPackageCab.psd1

SHA256 a09054f40694d5472f1f7814d0136de0225ed15d38f522df3bcc2b50d7752192
MD5 8ece9b665e1d33f3944d1871effb2705
SHA1 17d85e040b99ceb7cca03f4a8a73a3ce784d2c2a
SHA512 4f25706040f004f0fa5473ad7ec5e3a2c3694da6a0cb1464c3b1ef663a04aaab88c86a8c82187ec63733d6e40eedb0526f060edb0362f4e3b517cd1bb9b73734
TLSH
T1ED1159D016FA31032C7F1546F926C12CB7E897B243755360B42CC0D8AAE2F64C2A68AC
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCClassResources/WindowsPackageCab/WindowsPackageCab.psm1

SHA256 326669c4a31e2049e3750bcf4287241bb8b555b3670d31a1aca74c3ac598df81
MD5 b29f0d0c61cc91d9091bc38e208cceaf
SHA1 de6a02520e1d7325025f2761a97d36e407e8490c
SHA512 b8dd0d1c9d5222a2a45c7e956f72dfe64de928c27b3873d3552d4e305958679c739bda3af6f84f39e79dbb05dfc3dc30304acfc70d9c1021e140851132d6aae5
SSDEEP 384:v9KyeyaA4HZzs2rflLMB6ODfW3/lyAI9/p/tx1C3e5ekHC+LzvmoaJR30pPmTl:v8Lq2r+B6FkySHC+nmRJRkpPWl
TLSH
T11AF253B897510E254C33076DBF668391EF1F6127366640A1BEFD66006F72084E276F6E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCClassResources/WindowsPackageCab/zh-CN/WindowsPackageCab.Strings.psd1

SHA256 af0ca6953ef159e96e69ad7091654742e29e2684e3a24148da6ad26b0dcef396
MD5 f0486b3808abf7cbf7c5e76b87013c25
SHA1 02556cddaf9da9bbd0594f271c4bfe333b72c389
SHA512 b38eebfda8f6015ae2d674837bd11e8c8e0d1c9deb16bc8b61ab1ad7fab3dfc1b9eb52a1f4319667c16c4b08091b56924bb561ce791722420429d3f7207caf33
TLSH
T11001F99297F41148F0F30BC87BB21D220B36FD761A18D54C5280620B0CF9F918AA67A7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/CompositeResourceHelper.psm1

SHA256 4fb57f6a5fe776a46f8a7631d461c43ad103931b45ed674dc5bbd837195591bf
MD5 3ef0b1ffdddc2a4596620306a5a74413
SHA1 e5be706a360dfc71f3829375144f5f2c0727a264
SHA512 072fd63d2e5c205a37ce379319c2bbec4e04840fd41fce7dbf41f29fa024c508d28a04f71d0e268b20112fad6b55428d8626b9fa78db2fd3387b9a73b0f483a7
TLSH
T1EB81FE5E324A8955037516A1AA47A0B0DB6D21A37D771960F8FD0EC40FB6F18E338B5F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/DSCResourceHelper.psm1

SHA256 278e816943020aa1ef6c585636da1035e4d456cb1fb07e9a34a21d2690ef573f
MD5 e2cd488ff94f2d5db9d940ff184632c4
SHA1 d6f1401464b305ff715a6c562f729d65e8d4fe99
SHA512 46425717333dd251a079572a527ec11ff4ca1f6a8a8e7d2959512b867b6416630374153e5244bed06e52b48bff751a8b9a5ee6e71c4bc64c8bf8e4c532941b5a
TLSH
T163E0A78935CAB1654733853647876904E8DD05632CA30C05F93C41E62F70734D395D98
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/GroupSet/GroupSet.Schema.psm1

SHA256 5bd66229fcadf1fcc0ccfc7f880d44c8e5fa06e4e861b6504d41a553a50cf262
MD5 dab79e1f2220d0a4b126eeb8883eb868
SHA1 8646d79f996544d312e3d70f46155b863190b748
SHA512 fe04cb7e679ba33c763bf5d85908540e96ab7efd80d95ca8783bd64e1a29485b74adfb1cf640821b736cd2f23de653f0194012b535b932c955cbc995d0c7a669
TLSH
T1DA21DCA676BAC69441F94149E917C130E97C1393B2B954B4F4D592800FBBE2CFA3DB0C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/GroupSet/GroupSet.psd1

SHA256 53d46f56059fbe503a776e041154d15c1842ec705374d7d3fca5dcc880d7594c
MD5 9dd21007bf922050e8883cdf8a085f83
SHA1 abf5a6e53c045ad33ebdfd86d96079743b1fb914
SHA512 b5b4699f17793cbf417ce28f56c63b36afbb315bcae788cf0587e8e0837bd190dc3fa723dc08dfdf863a4bab7017e8cee53abe6dad0cd1291d18f7d90f2a1768
SSDEEP 96:rmQccGbegrHBudhRfAR+KVFc5wvSxRuIF5gO2v:1c3shRoLVFc5wvSxkpOE
TLSH
T1BCB15B8263FE4104F6F66E60BEB160360B377D4AAD38D76D0685910D1EF8E54C9747A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/MSFT_ArchiveResource.psm1

SHA256 163b8f591fe315b00ad753c5450316cb9eef82b4cc53d0b24573aad40547cc35
MD5 a5a5206edce88c864cddd4fa80a320bf
SHA1 7edc40a2a3cd99c7dacf985f32897abeb911cae6
SHA512 8a93118c41d79ca0c6b603054581a3aa67c2384f7e8d2ac14c48a7314a664d94e33bbe80e740895fdc19d0637e7e9f04f03c5722a4442e37e204cb13cc40a1a1
SSDEEP 384:iD8OL5GACJu8UiB9g/9fSrJGIErRtOCtFDrf74/6KkBpFFD1mEQcjodH4gH66km/:e8OLedCnIt8KWcdzVm2/zB
TLSH
T16203756F2985022E59FF237AAA578080ED1600FF47E906247DDD83C10F719A8977AFB5
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/MSFT_ArchiveResource.schema.mof

SHA256 6460c5cba74d8661e8167b0371a470cf73cb1fd3e60be83fc8ba2d273fb1a41d
MD5 fd734f603fd42919e948bd8274a62be1
SHA1 c4091e07cea09da1a70e4c14f63e43aa8db2b01f
SHA512 ae1ffced3143274b642c1e4f7b68e9fd98a3a2d960af143397ab8a65dd1e43b8801c61fa9594a1b4c2c50bd048f91eda3ab0598dc2c6e95402a1818e9e21235b
TLSH
T1AD118F43C3D80489B5B72E016B72147995A37F668E3CC48D12D50D8E0DF2B86DC32776
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/zh-CN/ArchiveProvider.psd1

SHA256 5a4c0490716dcfa2f006fcbc982298c7d25611adcef16685c405a75e3de16bdf
MD5 329678765185d283254a99ff0f8fc999
SHA1 00ea5aaf5d74031f34678c173f4052d298cf818f
SHA512 99e8ad8f3bcb4df377857077cb489a3f921a9d89825d4e02e3cd428b4ff046ad825e4b20a35e75d8e60906eff1b157d32ae36838f16491de54360d895015e043
SSDEEP 192:giboXK3LbXgaLadOo/QjlH+1MnmTg7k52G8TF4jqGcgH8:gikXK3LSOo/Qhe1W19Tqj9c
TLSH
T1A002869267FD0198F2FB7F549AB429268EB6FC566D24C40E0285114F09B0F81DEB27B3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/zh-CN/MSFT_ArchiveResource.schema.mfl

SHA256 ce840cd38ed23362e7331b276e86e02a57cdf60175552c6b672767c2ba8882a4
MD5 cd37e57b50d2e92017ac49362f25a1d5
SHA1 0788728262c8a6c5cf83d540954e391dc4238e96
SHA512 4fac22829a2b894997ea7dbecd174ef96e87f88edf036936816ade5064070d9f2d95b87f4953ff4cf4eb7adbd94553e8e0b902827023d8ec121da2a42a3692ff
TLSH
T1A931675293FC218CB3F62F269BB301A18E727F084839D80C2598954E1DF2F48E9253B7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/MSFT_EnvironmentResource.psm1

SHA256 4bc67e09711eca67ad549ee28478dd742a1fa8a8b2f220249add6aede0245981
MD5 f2fcbf1cd900c3eb4880ddd7155a061c
SHA1 c5e22c2fb7962a93016dd7a492a8f8cb3ba62211
SHA512 5ab2331261290d9a5cdf02279039c24baa8804cf0540b019d97822a904b86699b8ed5b247d077b6c05c5816c73dbddb397a8a9a78bd9645fe470b087ee29c8ce
SSDEEP 384:rQeGU10BO36z3YJcrwnF3rJSk1h3CD0Dxib+7gy8i:NVnnG+N
TLSH
T14FC27359BDC2147895F1C37C8D8EE05CFF25427F54BA0920F9DC42942F34A28ABADE99
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/MSFT_EnvironmentResource.schema.mof

SHA256 e8fd9bcb6a370470aab8fcf7a1330e50791b8e514d85c641ec3f3251b9013505
MD5 3845903f0d6d99233364206aea15e759
SHA1 ce97522f474ebed2f7ed5ca5a29af1ee0d2236eb
SHA512 adcdda53a4d5517b283452443775ebfb1af19363f4b47be2820e85aebcf956af344490c7ec7405d2b050a0ba21cab6838c83a9617681ec79d8cb962f02b6f96d
TLSH
T1AFF08282D3E80488B5772F0557B209BD86B77E514E3DC49E12A56C4E05F3A45D9313B7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/zh-CN/MSFT_EnvironmentResource.schema.mfl

SHA256 4ebc29f0242c989b0513faa995c3e9717a1ade3365e1c10450587bd74cdf1d7f
MD5 34343caafa1b0bf590a5f6fe3d93a073
SHA1 3883a77bbfdba081a5805566b8d214b6feeff815
SHA512 b581c0547b5342b86408cd41ab5907a0ec54767f2ae591ef07f403556fe92a8bcbec76f24557b3c9960349196f84a202a4092bed05bc99eede41b8b52ad124ea
TLSH
T12211E94293EC215877F65E1247B704B44E377E48483AE40C2494A94E0DFAF49EA253B3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/zh-CN/MSFT_EnvironmentResource.strings.psd1

SHA256 dc6f5d21c9381b47053a33254bef2e4c426a9136fdf1bbe4b27f5a3c9d863bfd
MD5 d380053fb4b4912cf64d7a1a9cfb12e9
SHA1 29bea174e272a7051e10fe98052493653c479821
SHA512 a42d2085a171dc67508b037a8a87a25da5955ee68ec676ff046ab8e40a543934e6e32801b4734b1f41e2f0713c9fa0ed7f7f188dbc2f0becf8e2249cb09c28d0
TLSH
T1DF31FB8343EC94007AA376789EAEEAE0C2F6BCC52615C20C40E112C97DF471995BD7B6
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/MSFT_GroupResource.psm1

SHA256 4614034b07246b4ad4e1ba3e3c657e19395eba7b6c2111262166695a505515a4
MD5 c15068d821194a932f412cbd80a31a33
SHA1 ffdfee0693dc9ad3a630321e043a9a9e84f0d224
SHA512 4b3879ccbc9339c3bf674c59089bd2cd81060f96cfffd6c7dfa8bcb7ed66bc442700d8163242dce98d1bd39bffc6fbb367dd714cca02fe84a1c5b4b17ad4131a
SSDEEP 1536:mxGFwtzHPBM4DBwJoGY+5WFyuqYTpBdpeJeJUaGuXVXDSdPum7srZnVR8MXAxW:mYFSGz16zsPum7QVRTXAxW
TLSH
T1347365A52A8F512510BB577ADD4BD404FB2D02AB92F81438BADC81825FF581CB27EF4D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/MSFT_GroupResource.schema.mof

SHA256 65d99b6f571d95c173569ab6e01a70f550c5a8ac0905e06d56358bd87fc999d4
MD5 47b306707b18ececc98878e8e0855235
SHA1 e2e965a8a5d23adf6d5f89f67a043d965fce90d8
SHA512 d0d475f64c14cd8f78cf42d709ba1b43303c354925653f046ceca59a1bec6691dbdff1fa88982d230274fde665efbd7e7c9c398f57ad73a3c05eabe09f7ef383
TLSH
T102017141E3D9048CB5B71F01A7721878AAA77D668D3CC09D06A9084D09F3A4AD931373
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/zh-CN/MSFT_GroupResource.schema.mfl

SHA256 d13b404b6699c92247b80037f008fc40f25da706b4795a39edb88ac59f86bad7
MD5 ba8d651de39f5507f1a1062030418129
SHA1 cbd556da279974df957aea45b5b712f00d97f11b
SHA512 b701d2d52ab50c11612a1bed93bed0cf641271806d4b94ab78bc4099632514c39984b8229ccb2ea330ae42b11cb1ad145353fd27078c601a8aec859adbe99af2
TLSH
T1DF31C345A3ED2258B6F61F229BB315609E77BE044C3AE44C2598914E0DF6F49AA313B3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/zh-CN/MSFT_GroupResource.strings.psd1

SHA256 27b0d421ca626ca739f8e0f52f20e41afc296d3db54f0b5f2add606f248a53eb
MD5 fdfb03d891dae833182a1599398a25c1
SHA1 d6ed91ae4c1ddc260edbe2ee9798286697ef600a
SHA512 09e30e08ad1b1c374dadbb8a8221479ff6b29d5f3c0d8879b3329087f3fb9b3481ddfef0d2cac9400dfe99291075cadb9f529f6f47a2fe5e30e9ad1b6a25f1a6
TLSH
T1AD5198926BFD1484B1FA3B20ABB10E625FF7B8665D19818F10CC412A4871F42E977773
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_LogResource/MSFT_LogResource.schema.mof

SHA256 df2549abd05b7bd92aa38188297364a47faea4c356c6cdd5c8aaefdc6dde2f83
MD5 b194c81cc0909214cfc5cf337f9dc5d8
SHA1 ab9acb8cccf476fda5566de07d4e21737953b69c
SHA512 944112259780226dee129cd412258d98bbb9726b3f1b23a8aab35d9c4b27c86f84b2b536280c4ae452bdbd268ff234421f45943befa95018d05b321d5517d52a
TLSH
T16CD023860465C8566673494B564620F2016862758728358DFDBC01A32A61149515ADFB
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_LogResource/zh-CN/MSFT_LogResource.schema.mfl

SHA256 b2ab71630634150ad12bcf1e64a029e3abc119408032ca6357122b67668a8394
MD5 4b58030b0789669564235535353ec2e3
SHA1 111034e5acbc094ad837d56e6364a27a18dd1d66
SHA512 5fca88870c94d34cd52ae85ade3ee5a5eac48224b5b9ee8960b139dfa2aa6aee08e4bcad59f8dbd0cc644292c6ab4c9a798fdf984b777bb9b4ded9f52ef09459
TLSH
T1D201A26267FC2228B3FB2E5186F205755A37BE144C2AE94C1040564E15F2E49F9623E3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/MSFT_PackageResource.psm1

SHA256 e375fa32e10537d28e279379c3bf4c0a761f6a33c88dbcbd9b34c13173fa3c07
MD5 ab836d06051ceeaca0877ac780dcd4aa
SHA1 608183965caf7bf7733aae1450cbc97f32b8f963
SHA512 f802e7e0974d1a6b41c85b36debed4c243d7426d25924e61a4bb6eaaa0d1061516b2730e95b807235717116d2c58b5592ea84be0d3911a267676773c03f43288
SSDEEP 384:wke9QGEigGCSgBpxATHywflhV8qFSS2Kl1JLvaaCCxFSbJgjBMw7S0mx1VWVvbav:wke9QziHPzb6faCzEFBvQHp1
TLSH
T186D2A59FE986011999B71379FE578281FE1A10AF11F00A60BCEDC1C12F32594D7BAF5A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/MSFT_PackageResource.schema.mof

SHA256 e0a12c369e966f9bc9f0ff061905bd031c2fe7dab0ccb23fe1aa8f17fd4ee91c
MD5 6fdaa836b4f1ba7b4a806f7bb63273d8
SHA1 68493b66b81bb11b7ef2abaf99496516c75daa72
SHA512 775e212bcc4e040a9239d7a7b4ec8ead6c775040b161b3b9fa5f1de6caac38a514135c07d7085248051545b32366fdc4231f9698dc7ae08b9296aa8b1f968a94
TLSH
T120216A42D3D5048CB9B75F49ABB604695AA3BD128F3CD44D06E8254E0CF7B89E9323B3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/zh-CN/MSFT_PackageResource.schema.mfl

SHA256 04b7d6dbd97a4738c5dd71e4c65d97fe3293b28431015e3c47ceaa3fa2a5b2cb
MD5 83026d50c4564ba91973d1ef6a1981bb
SHA1 434268a969d1cdeb94793ad33517a117b5ddde30
SHA512 2dc40beba94a0e04bec3092a6199302b8f28f5a6c2558a1a92d810480e7957bf287204daf0bc95dfdf06b0e9084f31d1d67cded2487c3536db6da52cd799baeb
TLSH
T1E041E501A7EC225CF5F65F2ACBB711208A377E080939D81C29A8A14E5DF6F4CD9653B7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/zh-CN/PackageProvider.psd1

SHA256 cc0a78607f0c27e57a969bf4fce54842b7e0cc0631c255198226199089d5069c
MD5 566ff8bd367892d815ae7fe21e68bec1
SHA1 bf15ff1b4bcf40a8e8678e2f0aa02328c99d8ee3
SHA512 6e8b6e026a5addb903bfbac7bcba801467d13b9a4e819ee1709ef798444d4a09eb8c2cfcd3a97b43481d401156b1b439813623c472d45cf6d5f34882573b3e5d
SSDEEP 96:gigA/zX2zWmJSqCOn2lcf5WT1e1o5YIsISmvBmu6oDqzHOTGRnSBoYQxAllg9:gigMYnn2KQYzTocHaGQod7
TLSH
T1B4A1248267FD0088F2F77F64AAB169660BB3FD261E29C44D5190520F08B5F419D6A3B3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/MSFT_ProcessResource.psm1

SHA256 45c656815feded87c81c9ad5566ac6e11468441206e6737199ef9dcd5310037d
MD5 403a3a7e0e95742d675c4abe09c72bc3
SHA1 a965de8885a49a963ded641a09dba88919e80539
SHA512 d20e3eb47376f208e3ebd04121f6f4414611526426bd8d9c749fb8ed8b54fd03703fa3390bf75f1c5bc79a9b31c4b627ea0d73fa6357f7c1a085d6c9c6858ce0
SSDEEP 384:uBIVFwB/PcKbgldd3keF0xcgSc1yC293rc1yfJgOCOtViyeNc9tRxfW8:eIVFwB/Pcldd3keKdYddVhDViyJ
TLSH
T1D2A2622A76CA019A44FF03AAB8A7C102DEA401BF35B60524BCDCC6801F75DB5E639F5D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/MSFT_ProcessResource.schema.mof

SHA256 928f2e3837700addc79e624cad1d3c24576db28b0fe8de661820549af30766f6
MD5 cab274262a83e4ef453b324c3efa80e5
SHA1 b1e0f8b722700f6c26ac5290214025c59e62d913
SHA512 045f1e82369450484a66dab14cb3351b73c23486881b0005192372e6e761ab170a55dbb26a7ca3a3213e459656686bd54852a7c662afe8aaa601c296347c7bee
TLSH
T197216A42E3EA044CF9F75F0597B6492816A37C96AE38C48D06A8180D0EF3B85D932373
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/zh-CN/MSFT_ProcessResource.schema.mfl

SHA256 d05db456fcb793195fa7116d69c3fd98b8077a381fe781bb3984a44cf595453e
MD5 57600456c3080d5f659c15dbb6005798
SHA1 b0e00e53b87d3dd133d9781b3df468f887ee5836
SHA512 8a3c81d6b1b1377729ccabe25adb1b0324f48e164a2e3fa3e81f11d49033c85d11eeecdf3a0cb39624c390cc22f9d5382aa712c2b9c45afdf23f3eea1920c9f4
TLSH
T17741D70193ED2158F6F64F229BB716205D777E494839D80C2DA8A50E0DF6F4895A13B3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/zh-CN/MSFT_ProcessResource.strings.psd1

SHA256 44c3e2f130bf66f15eb2767031206dd5276402db73fe411d176f2010ebfdbc14
MD5 72823cd800f99840bf0abdecfb6004bf
SHA1 849cbbb0bdcff2565e95b7b0bacaca689d5dd561
SHA512 fa1987dffe4e7c20d1818c7143d7f390c0393b9dad5cb9e1cb95f771a14c3be7a04b21c0b0bd731913a1c1f8b712ececc21857624513005d1a5b838e8dba1013
TLSH
T19E5137C6A3FC0044FAF36FA0BAB149A54AF7BC261E59C64D40A8165F0D72F10D8327A7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/MSFT_RegistryResource.psm1

SHA256 2014d15de845491a80be1132ca3784d60ed8e1315cf5942912956163d4bf6f4f
MD5 c9373c5f671e9a9000a88f51de6cc8c4
SHA1 e7dcf08a12de4ab9ff212160946a06868df8e6b5
SHA512 0354024b2297a27357d16051332815cef3176679c985bf9becc6812b7599874308249a83a9b47616253d80c43d8de305d511ae40fce2e0798f037a378b729179
SSDEEP 768:In0wpmRahlfg7JFw0wUmg5A4AVn/g4AZWZK4AWxCuUUrFbio17lV9w:I0wpmRahlfg7JFw0wUmg5A4AVn/g4AZd
TLSH
T1FB0384197FC3812940B3D2B98D26C428EF6A526B11B90A50F8CD45C03F79DA8F57EB8D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/MSFT_RegistryResource.schema.mof

SHA256 128afa2a25ed05d4ab9e4364074768b2ff252ce083cac61d10b9e5606c87d1fb
MD5 8d435564d3a5fc9b0cadf744a443f20e
SHA1 2e8ee701223085e2e0b2fe0523c6af32937bdbcd
SHA512 7f526873681e370b1b94bcae4965a22b704da6eeb2fc2e796d8bda02eee9d00db0fa491c1fecfa636ee3c1143017afe4e972c306936ccbaa0ca27ac8862567a2
TLSH
T17611AC42D3E6048CF6F71F055AB2683852A77E060E7DE5CD82AD0C4D09F2A45D831372
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/zh-CN/MSFT_RegistryResource.schema.mfl

SHA256 c676592d9b786516153740d88eb0eee841099e04d3d71d24a5dc562eb5e41971
MD5 a34eee0e536a74d06e8bffe9fa515614
SHA1 101c22107e6363e923075414d8f041a5ad9e9079
SHA512 5180b5dd178e2e5ddcee03661627ecf2db1991af271b1375f667c6a803c1a0fb4ac78ba5120da2289c24ba197aeec2dfb6cf97c1c57b874fe8485e9ffc583657
TLSH
T10D31C24193ED229CB6F65E1287B710385E773E054839D80C2558594D0DFAF4CE9213B3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/zh-CN/MSFT_RegistryResource.strings.psd1

SHA256 026627111e56a722b2d132ae06ac961b679864b62fa201cb4cf72941d199284a
MD5 d3d25064756f64d243e2650abaa92853
SHA1 fcdc337ad3f074916dbd2c5352f8b0aa0fb5906d
SHA512 8ce701b0887d5f95db4a2f2f314b5ff2c20a8a3016e382d685f56a36e97344e2da4bc84959a8979520df179146b03efd77c55a6e9ce737b626322fed56311034
TLSH
T1274118935BEC6408B1F36975A6FDD195CAFBF0461F8CD34E518106CB2880A05E9327E6
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/MSFT_RoleResource.psm1

SHA256 cf3074aeb3ae3a5ccfa7286f25beb0b4ea71bf2444d5efa045ec20ab259d1695
MD5 9df9fe978590c2e04565ab17ced37ca8
SHA1 61afdcc87f75d372d68eda5ee2a072b764b78865
SHA512 b70937bc133e4a40b8a98b6a9ae17dda148bb4a1145b7f4e15b2de5e23ea07e2e3571ddbc7864d2a0aa5969ba2e2f304942aaeb597d09a7a8f6903c64e494e21
SSDEEP 384:3s1F6XSaQuR6N4zvuR6NtrERxUQ8AWrbx:kB8y2bx
TLSH
T1D1A22D5EA24B43A9967702BBFF5BA044EF6D00DB64B81214BCCC44C23FF2894D669F56
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/MSFT_RoleResource.schema.mof

SHA256 6e7488da1aa1cdc8c52b2b7581cd54f61abdeef093b0471538b18e791706f89a
MD5 5e385d4aba9f2b63714821fdd8cae82d
SHA1 e396e68e1b3caccbc05119aba127834384a50641
SHA512 fa8a3f2c0dc53fecdb037b2c746d39299240fc3f62f180ab9cec4330ba100339bde0e9dd83c11390dc4f1c23e2ccca8db3b92bc227e34efc4e55816bb0fda70a
TLSH
T14B21AE42E3F81148B2FB2F116AB208784A77BD568E3DD58D06A4594E09F7F49EA31373
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/zh-CN/MSFT_RoleResource.schema.mfl

SHA256 e39e012ca3cc4e63576e120d6ebfa28e576a0c1d191a8b5a6b7a34950501a76f
MD5 17da0d97febb08a47b7c0367ecbc268b
SHA1 d3849c791a5455c4d546d0107ea066bf10250531
SHA512 6ac6b9a6563c43f0c64263372df9454afe381aff0b2c0f4495a5035401e5e67913d90e38d16d6bebb9262ed2456f9eba67933e9b323c4eeb234803f85120f26a
TLSH
T1B701D652A3FC2528B3FB2E5142F115755A33BD144C2DE44D1040594F05F6F44ED613E3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/zh-CN/MSFT_RoleResourceStrings.psd1

SHA256 fc1559c43482fa8d4149e88f8abe010084b874b6e7cee0a101611adfdcf4bec7
MD5 213064d199439d6574a979114a24d529
SHA1 1124f03d4af13718fe3ea110f3df086f2251d14f
SHA512 db03bdba151572d675c4d668f45efc7d721c9a413a74840e6f14b651b31867a3ee37d52c1e6d10a4ac3b5bd089eb41a9bf2b7c00c7e440efca5d8a47b3116a1c
TLSH
T14A514CE5B7F9081872BB6E24EBB55686CAB3BC431D39C84E5148401F09F2B41DA333A3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/MSFT_ScriptResource.psm1

SHA256 74d9287f86c0eac13fe5301dc7988eadc9447fbe4829e97e394872e57240be54
MD5 6c56d656d8a031524626607042df12ce
SHA1 aad050e65827168b193103874ab0c40854607738
SHA512 818faef2c7f2db1af2f5f1c6e9c976bcb05ac5acc9b47563d0fdd86eb746b935ac401d98822162d13b6a47acc94c3fac73e543ea91b19b609aa70469a4777a3e
SSDEEP 96:KcwS/B8RUtqvvUjJAKqwATFxuJoQIct+Gq7IxJthN101qw8Szu4V/Mzunu1uwWnR:pj9JAKq07t+GqkH101qVpQ
TLSH
T12E4232596E4FCB3901B74157ED3AE048C75611E7A0B8E208BCCC8CC05F72AA5EE25F5A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/MSFT_ScriptResource.schema.mof

SHA256 a9f8d741bf705cef818cd0b047429512fee3a4dd5e7f0ae5df97879c87fbfc29
MD5 3989a65fba5c3c4d5108f8296a589b70
SHA1 f4a0813d178472ac3e1155edf750ac79d7c93ecf
SHA512 0bdc79808bdd9a1d9b9e6c1d68786c4e6e39d53aeba76b8c7f3b10a2acfc48235142a532d5da0fecc07d12369379b22fa5350db4d6649bcd53d540acf7d9c238
TLSH
T17101A402E7E80568F6F31F1256F208355EA7BE104C3EE14D0298654E0CF3A88EE723A7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/zh-CN/MSFT_ScriptResource.schema.mfl

SHA256 cdaf2dfc382e5e4d0cdb4e093082580e4fc4542faba0b5cfa2ac42f59744e750
MD5 cbb7c92a40fa55d0b04f6d51247197ff
SHA1 0b7d803e5c36f2acc7dd8792222876773ffdec25
SHA512 6a0650c948055a72713ca209ca0078da21e800288e161f1a8b8df1e8d8993a2e9170e068fd3ded459ea6a577aa19328adb203382364d4104096ad752b71ed745
TLSH
T17D018F62A3FC2228B3FB2E218AF619795E37BD448C2AE54D1040594E05F6F49E9613A3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/zh-CN/MSFT_ScriptResourceStrings.psd1

SHA256 8f8c2794d5ce66b41e9daa8e309ede7d18fb88f036974c35e894342c48066266
MD5 f5ddc3baab941ef73b7a51df9a81c24c
SHA1 a5820c14eb5448e6d0c30b4797421dde64ca2938
SHA512 1d4f06ef45b26c2a8570e7526ffc39501246cdba2c2c62d1d673080106c7a6d70aa42e9aad5e1bda664dc62adbd5975214cb3c1700efb059d605f593bf45886e
TLSH
T1B541CF91ABF80418B2F61F11ABBB54A1CEABFD025D2AD50E504C448E19F6F41ED313BB
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/MSFT_ServiceResource.psm1

SHA256 689f3392d1057dfdbf5a08902440cb616ae5105d0c161de313305391e7a518ef
MD5 66ec70c6a19b316c90fe77129d210054
SHA1 49897df1a5443326d268ddd9aad5ba2ee3310314
SHA512 d0a703984058e2c3079825483516238229db52fcb14aee8fe79d758178bd8acfb2e2dd59fe7c87f4816e54ecc497e6c657c4624ec4c8013f99d99596dc17f5e2
SSDEEP 384:+xyVkVrtJUe4tjBkx7yzZZOe4tjBkPjyz9mz4wmcRci2ED04re4kvWKueaUMnT6N:+Bo9yBJZJcNSDDmVg
TLSH
T15B13941DB2C381668CBE1278DD57D118DE65407F21B82910FAEC53822FF596CE239F1A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/MSFT_ServiceResource.schema.mof

SHA256 54d658650d6fcd394ce69fa082617f74b17c06fdad590385dd860f7b819a77a0
MD5 5b69260b3dce18453cff9a62ccf0c1ff
SHA1 3c773ab8282a570b9f34a9b79d7b6fa56d7d64cd
SHA512 a93176150d7caddca286ba95fbf09b65d90e139fe4df22f391d1bf22d3fb96007ab17bd84a2b464f721906063f0bbf1cfddf4b323d90a7a7b69052b5ad6e8a0d
TLSH
T180317142E3E9198CF5F75E456BB2183D4AE7BD564E3CC58D02A50C4E09F2A86ED32372
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/zh-CN/MSFT_ServiceResource.schema.mfl

SHA256 8027ca43c4dd1aa363c563d344348e909a1e8d1ea43b203702c4274ea52a7049
MD5 062c20e8f86fd67d554aca8237f31312
SHA1 9f5c09f1b1f07ed1a24fafbae2b455df90e5b19b
SHA512 cdb71e0aa53f19471e19ce1c7365feed07e39172753222dc5fd210111aa9b20900e83e2721f8ac75e35522a0c71e35cd257178b642402843199b5fdc705e0d6b
TLSH
T13B41940693ED215DB6F64F22877719645D377E48083AD80C2A9C954E0DFBF48DA613B3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/zh-CN/MSFT_ServiceResource.strings.psd1

SHA256 2875cf2cbe2acef201dcb5d08390a82113df8beb6ba5f5350b63795639b93d32
MD5 6fe60d7775c6af8571211d87b9d4450e
SHA1 e612bb9ab3367a5987df7c1931556bfbd8b82a82
SHA512 ee9cf590eae32bf10ceb33e908401f640b270c9af720c63bdfe83ff48788fa852d6954f561ccb19a74a006c356a6f6915abb98c5a5445a68f8b873543700b925
TLSH
T12D71798A27FD4905F5F32BA0D672D6D14ABABD5B2816C68CC098018E9475F41C9713E7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/MSFT_UserResource.psm1

SHA256 b0caa0c3b9535c57a965610a2ab3c3554b34038f4d9460050ab02753c96845f9
MD5 4d50c59e77481a61fc41eba8b9278234
SHA1 1e00a33509c773a6da8e044eae506a0ddd6ccf94
SHA512 a5338d663f354899fcf96ea9d51cfd7909e0138d9088e034b6048274833a8a5cffc7a9da2cb34a2b951d0a2ce5e63d6c7defe64d7cc7871c5a8d6c89c9499fa6
SSDEEP 384:PbswwJoZwJoSaTWwJoW8enMwJo3TbWSBvaKwJoW8fox1wJo3Hrnc/UVhfW8N8Hvc:PbYV+xvn+qJP22qyf3SY
TLSH
T1B5F26F6E6683881900FB83768A599004FFB981BB51B90611FEFC45857FB6C65C338F5E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/MSFT_UserResource.schema.mof

SHA256 ef18de853f4c9da6a357e8ac90b05ba3683e2c813e5167681dc6c1431ea31a34
MD5 91090572ee7c0a2df0bf752940dbf2ef
SHA1 4c0e55235314ef0681a1ed90f913f26cb514dd92
SHA512 d7f0c56555ee0de56c212c84220c8a760595a665639e00d3f5f5e54174a5ebd6b2bbd508afb4e1f4e3d9b37e6d70e77e16c45ff39e99edfb921d752b7e779cd3
TLSH
T1E811E542D3E5004CF8BB1F01ABB264A986B27E668E3CC4DC0299144E0DF3E0AC931373
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/zh-CN/MSFT_UserResource.schema.mfl

SHA256 55f6d9cd67c4d50d7fe8d17354e05874d6d24eb272f6a8aaa777a7c3af243839
MD5 872d0ab960cf429ac75f24428ffefe47
SHA1 98073ae09409eed46d8f565c83fb37fae1e3692d
SHA512 ffce821e1d1b141ad573d47cfb8125565074a2236701d51ded0fbd1b6c29493c381bc2b9d2eadd2dd566688d7ac56a50da90ad2b462bbb3bfeb8bd33700cd28a
TLSH
T1F201D692A3EC211873B75E1286F205755E377E04483EA90C5884994E09F6F88EA623F3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/zh-CN/MSFT_UserResource.strings.psd1

SHA256 76ef5669c0fbf39f69733c7a17b29cf1118427f6492467bba0d8f5a30d29cdbb
MD5 b5b2a709bbee7ff38aa8bc73d49146ce
SHA1 b5cd1248346b8be00e3447fb33d30a751ef4f2b2
SHA512 da527f4ca8e005fe20d485f01b3035b4e788eeb272517f1c339d27df927e18ec3b0d3cf28021649535deb04c5db8c2073215df8d995bed1771919bbbe0f5c7f0
TLSH
T149319DE2A7FD1550F0FA2E4497F91D5247BAB8590D6EC11D21CD414E08B0F81E5B7BA3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAll/MSFT_WaitForAll.psm1

SHA256 8f9c7d26ed10799531c06c98baf259a64f1fe87e14a5494ad4b2fe156bd385ce
MD5 b08f4ac4401a78c994db434e6adcf720
SHA1 98a54ad02eaae0f7c3f95b818b0556385e9fb73b
SHA512 d426b81feaacaad71c8b850269caedae99584c4648876f44627f08a5b620d34f3682e649bc4a79a8a4fddc4dbe288ad7d64727a688000edfa30af1b2a09ae7c9
TLSH
T16F518B96A1CB8525387985629FA68408EA24354BF43D2054FBED0FE02F7D780D1E865F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAll/MSFT_WaitForAll.schema.mof

SHA256 db4444e40caa425235233eb7bae84868e8f11b34f54fd97960a2dbdd488ea58c
MD5 a3848045ba2619e5abdf524e4f76eed2
SHA1 f1be00d0e20b684a4c6122b79f1354ae45aac464
SHA512 46334e888ba01e92147ed0f1b27f8ce77e6bc2e6fe567d66a55e4d81a9b7825281e8bf9d8726e70fc0b03e758c5309a01a2873c64bc57bb6eac7b6d2cedbd197
TLSH
T14831AF0293FD1208F2F22F1596BA20289E737D129C39E45C199C644E0BF3D48DE757A7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAll/zh-CN/MSFT_WaitForAll.schema.mfl

SHA256 a632ff79d7c08e7e6fe85275ac059987e910deda970671e30942bdf08dcfa7bd
MD5 32201c28677f47dc13e33b20cc7ff16a
SHA1 3262aa55352f0e7192335424745bb101358b5be4
SHA512 64d1aff0cce7f8c9e41e66b931a5bf91709969995ca9f21447f706abd2f1fc3fcb72744666006c76a9c5508dbddd2223a0802dda6fe5090ab53a7edf22f30403
TLSH
T12D21B48193FC2558B2F64F1287F605259E373E440839E41C24DCA54E0EF7E48AA653B7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAny/MSFT_WaitForAny.psm1

SHA256 d479eebaa37f5dfc4a40c67eda296371801c2ec7c44f934c462557063dac3ac3
MD5 ee0536de9ce291e04e6c4646d6f9e0dd
SHA1 264d5f8d91279d5d6007c75d116c163755fdb662
SHA512 c8263f90b47f92e0b41d51b8a263cd46b05b9830bfd9aed344525f260b204b1ae940bf679fbaa1432d8b22c137762aba4594b5e44c3f4c235c33e00f50cbe7f9
TLSH
T196519C96A5CB81252C7985628FA68404FA24348BF43E2054FBED0FD02F7E780D1E869F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAny/MSFT_WaitForAny.schema.mof

SHA256 cd45e7e7262eaf927047e8e2cf4b624a1bcd70f421bc7175132fed60fa0ad347
MD5 a94f6a2807edd3ffc4e23403439c7ef5
SHA1 7adcd5bf00c9834c5e071638f5b30cdb320e8ef6
SHA512 c57f70552ff95d37cd5b57e1dfa39769f63143361a46dc41312ed7f917ae12e304014bf512303465010a424014ddf04649c8bbc4f57c9e2d33dfd47b4b38aaf6
TLSH
T197317F0293FD1208F2F62F1546BA20289E737D569C39E45C199C644E0BF3D44DE757A7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAny/zh-CN/MSFT_WaitForAny.schema.mfl

SHA256 307591ab22d4d80297be878c9ffd6f0eddc1b82e8200b6e51c97733c928fb4e9
MD5 60be1ad65d05ad3458a00c4fe167c891
SHA1 2a98f11548952c9bcb810f9fcc9fccede5d1650c
SHA512 439e8931add06297eccb04eac6bc580bf8a090a25a79213065bc7db4e908b5ca4019f5e61ab8958ab65416e9c7da4871ac0a2d44813b34bf944dabb9a58fc679
TLSH
T10E21B44193FC2558B2F64F1687F605259E373E440839E41C24DCA54E0EF7E48AA653B7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForSome/MSFT_WaitForSome.psm1

SHA256 8468b18057c3c04fa429e2be4a0efec159b412a83c5b35f4ad84317194819701
MD5 90d28e24003a6611807c4ef680d95ffb
SHA1 2f2f190e22eaba1c9cccde058b247dc7e5131902
SHA512 772305fb92c32d03ab19630514df300b0f23ca96c224a72b4cd4325db0062a5e32369d54d982c20a5430a20443c80b950fc8fe8ed6650b3bf51be90b5c48c9d8
TLSH
T1FF61BC96A1CBC126387944629EA68408E624354BF83D3014FBED0FD02F7D680E5EC64F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForSome/MSFT_WaitForSome.schema.mof

SHA256 c83b8198fcf5829439b1182dfc08a0ac699a3db82848b93a5ba1ae317ad19f57
MD5 74290e59e131ac5d58fcddefe7c3bd7f
SHA1 3230441d278fca66bba91c0b6cbba972f04190cd
SHA512 d86dab799e6775f0b68d71c06450b004290235d73c2e6d069ac36207e3ab20b1720961b4436ddbf1a2441be7934efb339dc36e6330b9afca74e5bddac2e206d4
TLSH
T142315C0293FD1208F2F22F1542BA20699E737D169C39E45C1998641E0BF3D84DE757A7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForSome/zh-CN/MSFT_WaitForSome.schema.mfl

SHA256 6d831b6d2f33570f91c413c4d36da4c6df422c4c17e6d420d34457bd767baf38
MD5 011bbb630ade9a66f9995d57f4c28bf9
SHA1 2c2ec091477b6f4e2d2571b99aa253a6ffa9ba54
SHA512 6a8d499e4f2596a2c64ad2b295d45b293e435d2a80ca430123033c5d01f1fbb047a2c462acb970ba24c0dad8dd64918badcedbacc028bd06e2cb67746fab9e77
TLSH
T13621A44193FD2558B2F65F1287F601249E373E144839E81C24ECA54E0EF7F48AA653B7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/MSFT_WindowsOptionalFeature.psm1

SHA256 7a4f80f5756f37e0ee9e7046028b8ce110c5358eba1807f8276ea853bcfae975
MD5 9b172a0fdb4cf64193dbe93ddb95e955
SHA1 03fdf219fc8dbf57742b8cc7808be5e6fb4e29cf
SHA512 b66d2936d690ec4f5da7de019f6227a5fd3b1ee80dfa7db5367e51bb7b0ed3e27492d72fdc42f4b638cbef817603c2cc51975dbc46f93dd18f812a7bc683caa4
SSDEEP 384:TLY1usNSPccOvQFr/VApCkVqP4S6n6TMjCFpeOzApC2o2XFrMUFrAFArvNDFd:TIkHxQS64uDh9J
TLSH
T1FB727F43A7EA5108F6F77F48AA7A10754B73BD1A9D39C95D018CA44E0BF3A00D961BB3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/MSFT_WindowsOptionalFeature.schema.mof

SHA256 7f54ddfcf2cbfb6f6b140a5f14bd41ed571ce15276de2ca6b169eb1437a5cfb0
MD5 1846aac6c0c05ddb843a7d6d30cb3116
SHA1 d5fbcde3c05d20b54b42ca2594d4ad89eaa7356f
SHA512 7964af5ee4848549c29e75248f7d5c1bc974c72023f0928537fefd14d700454fab69d321d8df479451c6867a076b210f861d7402491ed574c312bfe9f36c6ed7
TLSH
T147219A46E3F9004CF8F7AF05AB720838A77ABD564D3AD99E0B48480D09F1301DA2277B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/zh-CN/MSFT_WindowsOptionalFeature.schema.mfl

SHA256 3a295ff1f059b17fce9e01317fe1dfb4eda2add962aceb2f5901980dc8dabbd9
MD5 ee66addd29d92721da45d163a67c7660
SHA1 d874bd660a6e352fe2f3de7fa96fa5ec010d0c06
SHA512 b8e79abde90f4d87f203b4f40428783e7f001549c42196ba5a250302c065fea609e6d38ea489d4340a30c58abaaef9231b41c85ed16966335a07d548f97f671e
TLSH
T1E0410755B3FD225CF6F66F2287B311205A367E080839D91C3948814E1EF5F04A956377
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/zh-CN/MSFT_WindowsOptionalFeature.strings.psd1

SHA256 3657bb49df9fc650b50ad909020da1b2555836f4285ac554915462e5055300ee
MD5 86eeb527e4d4faeb845550b62d9b803c
SHA1 9d64d6af003ac5f3e114fb15f2e37e3456888858
SHA512 0cfbc323a90c6593f69de962adef8365899fe673de85c4d7178269099a2e279efdfd9132f0ed56e2f135eb9a665469cd0ce324d6406da9a31f4a736cc018b2c5
TLSH
T1FF31F895BBE60008B1FB6E75EBB662468AB7BD525E35D40D508C401F09F2F42E6323A7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/ProcessSet/ProcessSet.Schema.psm1

SHA256 0faeacc069d77763372bf508c524ba6b9909c4f6aa7bbd72f37fff297b69471c
MD5 3672710b10c1a55ff2b51404923bfab4
SHA1 09cbcac94f2e15775307cb0a5a0f2f6189a9ff41
SHA512 2a77defbaefede07600752aadfa8b5779131040f4c2f147b8732f937cdd4dab31898ee2e2d3486f6ad6536bbe3d6e9439b140f46cedc9602efccc8fe2b8b895f
TLSH
T179318F6236A6C29540FC4185B42A8130DF7C1367713618A8F5D993801F7FF69E638B09
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/ProcessSet/ProcessSet.psd1

SHA256 5b729ab531dc9a64d0dc16004fdebf328a42aa5f54065ac155f3ad2fcdae0532
MD5 2ae24b467e90e45e8fc578a106e69c33
SHA1 db2a7d7efe968d6f66afc25b388f9acb16a9ac82
SHA512 9b104ca118bf91593f2910fa1609b0c2c63fe3287e9d0d57a109d1db9d7ec94097351d1fde39234a7ee015e0d30558a25bed756128fada61dbc754c647b6e1fc
SSDEEP 96:f/mQcbMGb0gRPC9kdhRfAR+KVFc5wvSxRuIF5gO2v:fhcbHCuhRoLVFc5wvSxkpOE
TLSH
T140B15B8263FE4504F6F66E60BAB161760B37BC0AAD38D76D0685510D1EF8E94C9307A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/RunAsHelper.psm1

SHA256 59f938afb4337387be4420467d75699ac08cc8b1faa2bd1358db5b982dc4f1a4
MD5 216861143da1c86f6701277e699657c8
SHA1 28b61578f249e2ff1914429f0b9eb24cce8052b0
SHA512 91083349250a5194e09614eb41678b715c1447080769e97ef8b55a8d1f46a525ed2ff2f08fde54ddecde8e40bcad06d7b2c1af2058610ce2d12d198a26b937fd
SSDEEP 192:q4kzqrP5Bb1NzNVn/EJRbgG5yVLuzj1FIdGGuFO/u3u1APJpCgcxPlTw2js:ZkzqrD7ncJRbgBHQpWxPlTw2js
TLSH
T1327285261346469A46320239FE86C04AF50352771EFB4923BD7C93B21F36158F679F4D
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/ServiceSet/ServiceSet.Schema.psm1

SHA256 f6fed7406d3f4c4a03e2fc160a82c9d0d0ec2ae0022dc699903d76ebe1232f6b
MD5 9b8d8b90ab234735dfd2cbde900ed13e
SHA1 92342200417f6d22e0f50fabdccd884d295145cf
SHA512 fea3ac009230f80db71c39c8b94a737353391e74ef20aa386739b09e8390f3d307b9f0a6a07f567fe7f3232cbe495636693c0af93a6caa145b9b796c0d62ab33
TLSH
T10C219BAA7592C6A045FD50AAF926D130CA7C0327B0796890F1D592401FBBF6DE63CA0D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/ServiceSet/ServiceSet.psd1

SHA256 6e6a0a78c98b47009cd4fd13710a177bdd8399144946768ea82bcab3e93ac992
MD5 ee5ae639b0528780534d32081e9c5f1c
SHA1 6dc74cde2915017ef5058d77a99e8955134679c8
SHA512 f64a909cce37245ce3a5c12cfe93c4268c9da5c6dbcd69fe412e7a30c445d21c10e4528a7b238dd614ba4eb5bf04c33ac2f47f41f31a31d608ccd89a99569334
SSDEEP 96:hmQcGGbH6gRuPq3dhRfAR+KVFc5wvSxRuIF5gO2v:vc1HhRoLVFc5wvSxkpOE
TLSH
T1D3B15B8263FE8504F6F66E60BEB160760B37BD4AAC38D75D0685510D1DF8E94C9307A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/WindowsFeatureSet/WindowsFeatureSet.Schema.psm1

SHA256 f2b39854023ead7462a840360af4d186f51cbf79adb943905a7b89ad9fc03bbc
MD5 d05d1bfb009546901ad44e518f1ed484
SHA1 49bd7bba03f12a1d4e14cbf7b1f0ac4588dbc2d4
SHA512 deca7494b781ee1be5a45999d11f1808a89eedd2f6c752f57d57ee44010f424a51167952937602b3de0a28a5aba4e4e8d05e1e2bbd49988477df9e3d00ba935b
TLSH
T1D921B1A761A6C68404FA40A5B526D170CD7C1363717854E4F0D952806FFBF9DFA3CA4C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/WindowsFeatureSet/WindowsFeatureSet.psd1

SHA256 52b913b22cf378dbf33c69f8202fe11521af27fb0f899386a920930767bcbbd2
MD5 f166944e5fc2234ce44bfb847fc6df16
SHA1 9807e3551cdb762d2a744726eae99e9e1605b88f
SHA512 8643d0aa1eb14296a72ce1a18dbc61bb5cdf06e9725b63c54d215498d72b72142c840a068d726701c18ad425e396e8f72b39ed55b707e51495628ccac0f18a40
SSDEEP 96:3mQcgGbyRgkdiadhRfAR+KVFc5wvSxRuIF5gO2v:JcDyHhRoLVFc5wvSxkpOE
TLSH
T121B16C8263FE4104F6F66E60BEB161760B37BC0AAD38D76D0685910D1EF8E54C9307A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/WindowsOptionalFeatureSet/WindowsOptionalFeatureSet.Schema.psm1

SHA256 3caea9d6fc5760f5bb1cd0df9e2b644b78a73be54a8af3146189afdfc2481f5a
MD5 8a106acfc116ceb1575386cf76963c0f
SHA1 656bdcf70eb496f8e626cfc44755af43a322a1a6
SHA512 bb44bbb7ab4d652376214e50471d0a6ced2c4535e8386f52315c3c8f25a2ca1ec458876e30f24e0a94f6c9f2265391ddc1da6524ea1ddbc519abe0c729aaf64c
TLSH
T1C331C0BB3161C69004FA9094692AD130DA7C1353B23858F9F4E992805F7BE69EA3CA4D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/WindowsOptionalFeatureSet/WindowsOptionalFeatureSet.psd1

SHA256 47245d3f4b730861a4160a6b35722d0b584f7633a4bc99643ab7a9d3956fe42f
MD5 c00068e21f6ed99fdbd901ee134aeb68
SHA1 7ae128d2630ce0e3664aeafa39bfdac0696f1a3b
SHA512 5733b6a0c5d62c1fa53c6d1d40cb4d6595a7ae611d0f4d38018014e5e85ab595beab7ef84d9263377ad43196dc7e76a1a9bdaa734a7a04566aeca5174e8fa02a
SSDEEP 96:hmQcmGb+DhgkdiFVdhRfAR+KVFc5wvSxRuIF5gO2v:vcVIfChRoLVFc5wvSxkpOE
TLSH
T19EB14A8263FE4104F6F6AE60BEB161360B37BD4AAD38D66D0685910D1DF8E54C9707A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DSCResources/zh-CN/RunAsHelper.strings.psd1

SHA256 c560a06d2df72f992cc26329fc12e0c67b716c33f91d003eeecec48c017273fb
MD5 4302994cb3ff7c383641ecb8889f58c5
SHA1 1b1aa38899b821ea23c2c6cfa548931fcb038af8
SHA512 a86375b75d7879f61469897e315d7f0e61ca615146c8fdd9153584dfb726ab35c22f4a596e9aef4dc5d313a16f7c3b7f2c5ec01a8b128f58937e417914483e3f
TLSH
T16B21058357F62018FBB32F44AEB66C614B7BF462BD2F855D8084410606F8E54DA3776B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Disable-DscDebug.cdxml

SHA256 4f6c08753a6e90148d73c58b94c28b32652b9f366a2f7845d989bc5d1f3fae9e
MD5 7daebb89fe3a964361f74435787455d8
SHA1 2b1489dfb9f57de4dfc213973759cafa9351f106
SHA512 f0b83c79f5bcfd678c2854e0e684f6c8b8f3ecffc05949a3c1acfa404ceb4ddd98bad0f5db04b082b567aa1ced0a01d9e5a6ebeb513680e2f1e3a523d83699c3
TLSH
T17A21FC1257C999D3856BD20E82E9C455EF24234762684C5CB0DD7E0B0F73849B783794
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/DSCFileDownloadManager.psd1

SHA256 61e66347362f00475e177b0041ce424c099aae8091471425029f61d25fed5575
MD5 7e8c12f8894aa2830dc9d2d66da15722
SHA1 542b86f5eac09e8940137f2e2fd7f6b04f4ca97a
SHA512 5cfc9424494e08b8cf4b738c417c75fcfd8b4175066f265718120bf18d1b6f49403113a828c2ab96c3220749bc3bf31442363fa7de4a2d314891fe36b862c9bd
SSDEEP 48:tn9b09A+fb31J/ydVjVKsbd9VOPeYcxWYojfAW9ZHBFgeB9QZ6QxRuIGH58Znv:t9bx2v/7G8RfA8F57k6QxRuIW5Anv
TLSH
T12DA1774263FE8104F6FABE50BEB060750B37BD4AAD38D76D0685910D1AF4E94C9347A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/Microsoft.PowerShell.DSC.FileDownloadManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b8d680f2d3cee258a2333e7bc2cdaa7fdd27b2d8456d483a34b2ae8d2aa17114
MD5 571efe56e225b34d32bbf322d772d183
SHA1 968f070b3f90491b7bcc105c00e3b1307eb15154
SHA512 039d3901b365ab00d6624a7777f20412453c9e507da84ce2e4488818d07577298dc0fa271d68b26f3139d7fbc8164ad95c9dcc84ef8a8f87170e594d572ee77b
SSDEEP 768:FGR0MlQ6+gt5cuz1ZHvWWWW9UWWbWWWWWy0zCcO3P3d/YJs4UtrJ+BHyZ0fgH18V:FGR0M+7O5cuz7QJ3P3d/r4UtrJ+BHyZO
TLSH
T1E0F2392263FC8A1FDAAF05BCBD3454104572F21B6126DB5D8DD9648E3A23BE44A433E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

42030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.PowerShell.DSC.FileDownloadManager.pdb

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/zh-HANS/Microsoft.PowerShell.DSC.FileDownloadManager.Resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a5ab2deee2e58698d3dfaa26ced725dc5c609df7761711f6c18032d7560382eb
MD5 35fd08773bf50f11fab4a0a39271fadd
SHA1 4d57e0f8c6eb818ab09f48dd0d1658a2092f6dfb
SHA512 6d921e631e6a81bace951a95b6ecca1b3dc3c96cca39b6f0a19d0fbdd2f88716a3895ce429fa688f66a8e676e17a0aa7c60c2e2296ed842dc200c2c3cbb58dbc
SSDEEP 96:E8Ij3k2fJ/4BmjO3NJ02EeEOD2FTpllWRVh9MW:E8Ij3k2tssO3NevlflWThGW
TLSH
T1F2C1ED5617F90999F5FB8FF87F764215D837F832AA61C24DC881054A2872E70C9B27A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Enable-DscDebug.cdxml

SHA256 79b1eefa10e1834b42c6b29ea56daa8307d9b80a1735ec2761170a8cef9f06cd
MD5 20f2c178b27ec5d01cb05dca1abff3f7
SHA1 992079bf3cf44151b611f35cc574c6416b34953c
SHA512 c7ba13d39d0dd9ca3484755bf72d23ca3937e6282dd6637dd821486027f0ee3cc57a86567b1b05126788c48b1db88166ba17fd0df30ee500c2122d544447046f
TLSH
T1A321BB1267C956D284AB822A92D9C460EE3817C3315D5C88B0CD3E0B1F3BC89BB53B55
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Get-DSCLocalConfigurationManager.cdxml

SHA256 8abbb428ffdf34840f3aa23a15386c00032c27a5b7a2ba8409625f16ef93de0b
MD5 ad3f9e3f677e6d2427dc24020292b39f
SHA1 50f4a56bb92e42a2c9321c48e8c1698e68d03c2a
SHA512 5525bac314629344e7fdff900a7ea19e5203eb1f601e7dcd6baaba2182cffd3f53b1decddc36e1c6da8467c390cd8ecac0f2174cc55319540d66b37f16553885
TLSH
T1B531D25363C989D2C877920BD189C860EE346393315D4D4CB0DE7D171F67846B783309
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Get-DscConfiguration.cdxml

SHA256 66a94fdda0448ae28fe13ab652d4fa9bfaec981f7cf193fee3222eb07d08d690
MD5 bec3ac3cec18f3ecacc1c348a46ba762
SHA1 95d7a357ce1e0552bac6c7d4d892c662763d2d19
SHA512 2749b23b0db602991e32b16981e0121ad526056640c0c73be4eca5c9ceccfd019b96698946ddeef020dc0e38a316bdbfe21e9afb170422f1252827fa3162a8df
TLSH
T191219D5267C98AD28473820F92C4C860EE3423C371AD584CB0EE7E071F76C55B693358
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Get-DscConfigurationStatus.cdxml

SHA256 e69e30a599199dbd7b3a1fc8e32dd93dd166ed06d0a748054eeec06fb22759ee
MD5 b32433cf7746f3d2c82123eed010d03f
SHA1 773545890667be79a77483cc2833c490e1d0ab88
SHA512 d432127b851fcbe3d752e6a1e0cba391c994916571a855a85cf2655f813141ac8dfc1ccc8aeb37a5fce91fcdc414417207801edf664438692153d42d169be316
TLSH
T12D314C62A7C547D28873410A5294C870EE7427C3719D0988B0DE7E075F7BC95F663759
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.format.ps1xml

SHA256 9d19b663e2cfa9b44378f03731ed26c9659f44471b41913ea423988831350dac
MD5 40e7c1865d29f7e41aa49bd9c99aad83
SHA1 1857afafe853837b70661a6542132cb68446e56b
SHA512 d69d9d3b2f2dd39d1dd2c676df11d14e7952b6008bbd5d6e254fde2b006ab7f85d79dd626620b7995c8b186468ab11e61afea686eb9a430ba25e7d8c30bb1be6
SSDEEP 48:crgL29eLkXsk4j0YHbOXscM5HGZQI+XsjzBHQI5FhoT3:O0WeLkXsk4j0YHbOXsl7xXsjzBwmoT
TLSH
T1ED725C0FA7C43ED55CB5841ABAA8A235DE10620B5C7E2564F7AC470B2FF2C654133A3B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.psd1

SHA256 e1c03ba87f29a66b54e7a005ddcc9d667825f02fa25c29f0a1d5b3032e0f3639
MD5 f09a077e97fb7997ded1982a7d9dd0e3
SHA1 4de8b5ac6d4861b62e0766bab20847c3dcedf912
SHA512 cfca57f2da09acb5c5777004dd605e3453f043674d70d5ec13fde2dd962de76b2017e71b3e86a6667b49ad8c73c6598fb9df2a316a56b6836cc846e08948c5a5
SSDEEP 96:2YD9o00tHrXMVSuQApcbaqmzEVSpOPVEYRv:4vkgGq
TLSH
T1E8A1E912A7FB4A14F5F24F946A7A18245A37FE1E5C3DCA5D148DA40D0BE3E5088B1BB3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.psm1

SHA256 5bafab560092dcbf6592b4cee564adf515e1839a3d724f2e4ef9bb5a1191704d
MD5 c5a5651a1a90c0ea6b7fd4e9273d3d7d
SHA1 224095f016b5268678bec210a4c9606c82b91a21
SHA512 c0ffded92d2e74372a564a993ad0abdbfe1bea73742b048550e1363e58ea6674e484150b952bf4bb562255913f9f4c6073a29969017a324c749b62c4a63f3460
SSDEEP 3072:qwWb9zbgzy+0cZUWqsrefeMexH2QEB2ixag/CHVL0YJkMuCHUpp:qw9LUH+H2rB2ixag/CHmYJkMEp
TLSH
T1001494577A098A3352B3437BE9D7D044EEB5022B49B6142CF9ED81C41FB2654C3AAF4B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.types.ps1xml

SHA256 df8c8f079f8a51ca49cdd9383b8aca7bee7d8e9a4bcd87a99a889eefa10726d8
MD5 f9675f242fbb6dd5bca3531703d9353c
SHA1 5bda67d923de74b97661c5152a3b4b88cde3b2f8
SHA512 fb18c98ce053b97e598321d4692e5843f1a8afe741015c5f3dea6b7a8e9e9d876b59c986dc1c0bf2f5c65a29b4eacdaf77cab17421694309495baf78baf708ec
TLSH
T1AD71AE41BAEECD504831510B9A2698C9BF32526741D749ADF0DC7C232F3CA9A8F93D79
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/PSDscXMachine.psm1

SHA256 e1a8a19e675bf45db4aa23f2a01ff65612c888d732939ddfa4f531ae02318bd2
MD5 4865be535d5005a44116bedefd1cc61e
SHA1 555b2279f92f58b2ca8c4384c614885fac8af537
SHA512 a07a6ea57c6e3703712d3ebfbc56c5b5de6382776fa5591e9df3f34e4dbfe3eb57c5e8cc09df916e341c6294263de0f3af62348c6070a1bf6ff0175abaa9a15d
SSDEEP 192:JGB4VjxVYXGNRVeaxVYXolSJdEQN3rxVYXoHSJn5BBtbYb2i3bxhiZ4LTgmXNaqJ:JlxSXIxSXOSzZrxSXYSXCb2i3FhTgmXR
TLSH
T17F32212A54478E1279B311279E668054EE25142FB37D9409FFDE05402FBE398D2ACFEE
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Remove-DscConfigurationDocument.cdxml

SHA256 0c36f3b7a2a2cd921c9b980c20a934446889a0a40dcba7ff0c65771e0d0f09c0
MD5 648b6f5a69ff201e3579b7f8baadabfa
SHA1 a1d47c35838ffd6bcad80a0f6c5fdb06ccfa7a6a
SHA512 5bcd3a87d3c4fa49eb67745cb737f9077cd35996ce13c4b2c8e461ea34a9e75feb1b5e02c32b47730cd8ffaee5a308cd15c8a3bc49aedf2607094b41dd172814
TLSH
T18C41BB5127C65EE281F6421BA6A5C460DE7853D3B25C184CB0EE3E0B0F3EC92BA97B55
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Restore-DscConfiguration.cdxml

SHA256 346b03a09311230d898e44126f0b7c4d01475e487477a4439fb232eb04aed743
MD5 88476d252a205389ff8732d2a8da7b38
SHA1 9a8ae43f73440c7771397b673f6a893f0be2d69b
SHA512 7fe19fe6666d2c8696545cdad760ef935ce851bf9a810b43fd2ea144e83d53f8e65894bbad22042a05c31666b8fcc702b0e799cd84bdfe61cacf2cc428864168
TLSH
T1F911EB525BC586E348B3920A82C5C460EF34278363A90C8CF4ED7E0B1F2244AB783794
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/Stop-DscConfiguration.cdxml

SHA256 4680815d78af71b69f8e4866c13f179304115fa154b2adc378dba8b86bd3c436
MD5 f13a044661339b6a7e2d1bdf38fb75e0
SHA1 3e5b6732cf1aa75e9ed3cffba6afe0ec5eb03b5f
SHA512 c652c867b37f6161b19004b18f46ed27a908c7a0ec3a37d6bd1a11a8f139e3f9fdf756fd3059b455000a2a629e9e6acbac2169e5e401ba7fa924463701fe6328
TLSH
T13D218B5263C946D248B7820B92C5C864DE386393719D5C8CB4DE7E070F3AC95F753758
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/WebDownloadManager/WebDownloadManager.psd1

SHA256 3b0a4820d495efeb7e53602a82d76b567e00077f2cf6c225908cc9c3800fcce1
MD5 c83f8b2bd951d902bf5f3ec61fb7fbe9
SHA1 0889b106c2f95f7173e29909bd0a390b78cc7050
SHA512 a1a336f049f6aff21542c0863dd690776a940cacfd3928c40cf4184911493f7d56423d8ac2fbc6c7629ee27ba5ef4cdba5dbceaa5eea5ad6e885848c498b3f04
TLSH
T1C9516A43A3FA4600F5B65E90AA7228351B33791D9C3C8A9D05CD840D2BFBE54C876BE3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/zh-CN/PSDSCxMachine.strings.psd1

SHA256 1cfca91c0bf942fe6bcfbec15289e5d8305f8f7cd8e50b8de1932ad7d7938d25
MD5 7fe7619346b271617774b4d9b0b391b4
SHA1 bfd350340649e601b176248d3e6226f96c377ff8
SHA512 b07b278e9afe10f994e8f2d2447f36e3b3cc62bfd6a8ced95f6b3e0cee6162e66f4c4af690767f1322def178635aa9b52e4c6162501873a85104eb7ed69afbd8
TLSH
T1662147C25AFD1A14B1F22A5472F459A5DFB7BC312928E24E0054509F17F1B40DE257EB
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDesiredStateConfiguration/zh-CN/PSDesiredStateConfiguration.Resource.psd1

SHA256 8e7434eab516a91fce95f8df3de4c8e905b75a00e99d310d18476372734bc863
MD5 968ddd50f889188de980f19ce40f7117
SHA1 2616698d15716beea5e3ab4eae88050d50454239
SHA512 214b372065e3d82346eb7a5077fcb74ce47cdd3ae9c80129583bff16b96bff1ca4736c93d1eed1720d477834afa1bc18d4874e3e7846c66bfb6eda3bf8b7de2e
SSDEEP 192:gig/yb2XNcuRc5uqEUcMAEQzlfTZfQZWi3Ikxi2F1yFCahI:giQy6XNcuRYuqEfMAnLZuFiSYNG
TLSH
T1C002A793A7FC1548F2F32F60BAB5589589B7FD220D19C18D609D028F1971F449AB27B3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSDiagnostics/PSDiagnostics.psd1

SHA256 d58effe71f0b6d5b1842a9cc3c49c6a3fb3b99ffcd72d9d772acd161f71c56d9
MD5 15a4021d26a041ed70c9d156a7659a1d
SHA1 d4cd9abcaddbc74b892ff534e8948342a7201952
SHA512 252f6c1e0b3319797b34335238a460b671c992249341b5f992d93168d605b71d9f56551a5599f509ad2fdb99def0b008decf8ae0e350efe5b6cb6469f7eeacfa
TLSH
T1BEF02618F2582E76EDE66372E108898AE2E49F83512985247239A34D0F23947824280C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSDiagnostics/PSDiagnostics.psm1

SHA256 96faaefd5ccdce0d86fd1ecb9b8be594aa3fb32d4bcd8fb1254304a8cd9a7d07
MD5 0d9d7d46d0655476950ae995b5331e12
SHA1 d64d2d63788630652c701cefc9fa9829de9d50b2
SHA512 5132856244026c3266ffd6f79febbf1b00f6c1e3392a3c8c1fe712e6e3141fd00c104e3400d2921811bb9c7f416b8e45dee0a76067c5ffe71624bfd375103c41
SSDEEP 384:tJm+Q85rQ85Bjh8Wl4hLfEjyhiqY8KGCU571V5Is/Bo471r1d+jv7+7P4kJ:tQ8Vb5Bjh8Wl49cuh8L2dZdUY
TLSH
T1F3B2A94367EA1448F1F36B1AAA7F08750B77B855693DC91D01DCB90D0BF3A4498A2BE3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSScheduledJob/PSScheduledJob.Format.ps1xml

SHA256 68d0b9ca9c489a224c10c34d22cc19a525a401a1b06f77169a8662a6cbeeb614
MD5 5510836f6d7c851ceab82802cacde27f
SHA1 fa521a4e06e307a7832827c49774c86139660fd4
SHA512 7c7f41a4764a6b3154c7f3571037cbf49828ff1941a67d9ecb259d2c051797743966edbe819f1385b2f22d97531ad5a514db79d442eb3806e97be6588297a0e0
SSDEEP 48:yyD9JoiLVtABiQ+ovxByLkmXwBXdXAX1XIDk+kw1+xXoaK2fVtABwDsVbxByLkm1:d9nAbJAk2loibPATAk0Slofj
TLSH
T117F1BC9323EE5118B1776A5C3E7248B08F27BE212579D9AE50AC310FDFE3E1246417A7
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSScheduledJob/PSScheduledJob.psd1

SHA256 452ece86231234e9979d7e395f675fc4e50836ee74f7bf6396eccec356ecbfa0
MD5 6c20856b5f2e297a389e7feb72acdcf9
SHA1 412d52f2a68930dcb154140325a09c187f9c90d6
SHA512 208ab3c9acfa58b5f4c896cc328809e145792a9607850cc17fe06f4ada2fda7cbb1ee87c5b71803a07ea2d2b643123078808d433243665b8a15cfcacf691b242
TLSH
T17D117B6F821A34DA284E527BF4847481BA645FBA8139443DF96C814C0FD2C37C391878
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSScheduledJob/PSScheduledJob.types.ps1xml

SHA256 31e61807232cff0795a03bf1dfeadaf901b48d81219a1a4a0f3fa23982747fe8
MD5 8def555241034790c3df6d5a868aa0c6
SHA1 d770da52fcd5ba3d3e7dd13291103ae16ee45e73
SHA512 439e256444abd007e7241db13f5bbbeba9a70edc8b5790d0bdedcf9c165ca6af732cca476ee3ec41078f188d2b72e23b4848901cfc7b94476a999fc7bee17043
TLSH
T18751D412B7FE0D08B1763A58AFB9C4398632B8E4953AC75E1360210F45BDD118E11B77
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSWorkflow/PSWorkflow.psd1

SHA256 06151b55761067dd3f679e780081d4e7b2f99a3ac0104db8d7f83b3b0ff507c6
MD5 fc97a75cb018eaf8422ee3fc35889e47
SHA1 5fbc8e956260374636abe7cf03ce9597358eb258
SHA512 2c393dc9128374168c215785228156dee2e7bd3f33017ad13f173f2b136950a0b9158e2ea9fcb260877a8aa249009c4badd41a01a42f8f79f67118f25b83f83c
TLSH
T179F0086FA04C0733FB8E655B8100D440B3FC6FD3551D8A55F34D568802C7E68D34115C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSWorkflow/PSWorkflow.psm1

SHA256 9611e4caabe1165f8b81adb966fc5c14f61618260ef8df7e1ad3183fdd41ee5e
MD5 b8694bf50989122b685b741cc8eb2da8
SHA1 d31a5e3476ef23f774c4710c6e3d6f5be2b9118a
SHA512 e09232af1019df4f6bc1d3458dbc5164bc63a61f5103e689cfd84da5516fb3f7625f2eb9bd3cf4521349929b5abc39617c026a3ff5364160f3b695e7b8ac8496
TLSH
T19281400263EF5508BDF30A98D5BAA4B52A277D3D5A3DC5AC00ED709E0BF35448E517A3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSWorkflow/PSWorkflow.types.ps1xml

SHA256 b0406932b25eb94811086c9f430b3cdb63e5dfcce9fbdd698c6c9dc9b1a0b179
MD5 28f50144dba26a899fbf46deb7f7212c
SHA1 2d37745c02a5362397ad2e2022642cff053b8612
SHA512 98961b01db3bc1d6ce8740ced7362753c1a1286042ba1aa53dff002cb15e46f8895ffa6bf6cfeb646a73ba80a0d7b7265f9fc25a8857e3632cfc7d62cf5173ad
SSDEEP 48:yynlyHbGUAxirUqoa0VTfuVrZK6mIBbuSmXeUpba2gr5HpBMMpRboEMsbW96mXmZ:GyUAEnoa05fjDcgIr5Rzjr5CN0
TLSH
T1F402040363ED0918B2BB65285575C4B84B6F78A45A3DCF7D02AC700EC7FB911AE10BA7
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PSWorkflowUtility/PSWorkflowUtility.psd1

SHA256 d1399b6ecdeb8f27fa7dbf0ecf406e2084a161f7a5d77aaf9bbb7572b762bad7
MD5 70d313d846180d8c08d93fd88f0c2ac9
SHA1 d308fd1ea4a875747484f61a40f794cc2fe38fcd
SHA512 068a508a66d7e0ef460fa0eca8d52251e66ace8d537efa3327534b40c4d872d154aa64e3d0ab0f269da0dbaea4869414a9b9fd2dfca5812ad2c4e87075a09333
TLSH
T1C5F0D45F14181563E5593757D641D010B3F9EFD35D25CB4DD18D13C80143694E386454
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PSWorkflowUtility/PSWorkflowUtility.psm1

SHA256 cd83c3c293ec4d24d3328c74881fa04aaf9ccf73e099631a9eb100bd0f384f58
MD5 89d5599e42d5a02db9ae1794eadb363d
SHA1 943e307be7b0b381715ca5cc0fab7b558025ba80
SHA512 5decc5158836138f3e7a93f1036853a460da97f193efaaa37f13bbc014fec6d2511a4795397cc2511641e3f6198a20a7db21c4491f96b2eb1df0922ff270c6ec
TLSH
T1C631580263EF0518FCF32A99ABBA94791B237D655D38C92C00EC705D0BF35849921BB3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PcsvDevice/CIM_PhysicalComputerSystemView.cdxml

SHA256 47b2e09bda9af107a84682c3f54fa26e75d3496ee10400c24b2028d5bacbad5e
MD5 290a486b08ad834f796ca40b0a42e4d4
SHA1 f311a5ee9c0dec406f9e49a4d48c3e1d12b883da
SHA512 c9616e8af95a2d5a4ce4c20dd1e2dfee7e39c14951ad496e718859eaaf4a4f00c43d4e1ef691c27b972f40c4a2772064fd1a76e822341f69bedee6b477553ec4
SSDEEP 96:pYE9smUTVt7V5tfIhOVMoV+2Vf2VTJ2VuJ2V/J2Vh2558TVFFVBdfghOVcoVW2VW:rla15CGObdKCrBvhYp
TLSH
T110428B1023C40ED581B251696AA2A870DE7996E3716C085BF0EF7F172F3BC61B9A7702
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PcsvDevice/PcsvDevice.format.ps1xml

SHA256 181421a2cd108fed2ac056c645d5092d36c05de452befe56cb06b537ed398701
MD5 ba8891555d231810e0337216a8f5715e
SHA1 52038aacee4affd118a4c2014180bc63633cb9fe
SHA512 885076fe48f96803a59ce7bc5039f61805427a1d762b005270cd92f148c1b1bc142018d023e891f6daa61e824ece3c02655c06e4edc08fef40b2b624aeac0fd4
TLSH
T19941610B53C479D64636C4569AEC5639DD21A15B082F7AA0F68C871B1FB2D0A8633E37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PcsvDevice/PcsvDevice.psd1

SHA256 9711956ed5752ffb1fd66af398f4060e3fbf872a3f0bdc64743c85d6d6a180aa
MD5 36e8e93fbb3a9c99a55b3665a949becd
SHA1 30304deda808bdf5a8526c6d4b2c2335c23390cf
SHA512 7fa88c1a103018cd1c4b85a5cd409b0926b0d872cc1765be945d0519245755a258ab9599c2f681b3dd2f39bc26593c74b39615e0e09f9997a6ac522e689f7bd1
TLSH
T19E11CE25952E410B84379643DD09CC44E7A09BF3301B810B797D02080FBBD6392CD564
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PcsvDevice/PcsvDevice.types.ps1xml

SHA256 ccb4e9503f0ac02e4e31839811fc9a43e245f6953a4055e8603ec85a431cc94d
MD5 776044b0aa1e6b24d79e1ef3fd653694
SHA1 9a4a3b81f6fd3c9a299c68b35b7c4557f327b552
SHA512 b37df2a24b73b0e2993b5870c954decc804aed3cdbf4ac524172012d5d47ffa26673a64c70bcec039c953c8c64aea0473bab982a45e9d614b6f8947df2dcd692
TLSH
T1C211BD10F6FCC8A189B52127EE26F819DE21519B407F9568728C8E833F34884D74BE3B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PersistentMemory/Microsoft.Storage.PersistentMemory.Management.Commands.dll

SHA256 ebb6456dfdc0c0a0bdef3583d6259a841aeca7066832da3b49f83d50e81ed0a7
MD5 5f1d06009d4eb395d1ea6d0c6fb98fe2
SHA1 a39450acf0c974a0f41875edf27928fa0c56dd08
SHA512 3dd38f1989d360bd8a18babd5c50a7f9cda31ee1b0601d635cace3d2044800826455d0f4bbb56c3b8a385bcac80e80e1d1ff9cb6ff5526e4499161090363766e
SSDEEP 3072:suDaz503TSn8Mxks5GizGFKfLiafO32iB8fjYNl:HazwTZMxVGiZiTGiBP
TLSH
T153E31A1EF4393F7FC608C9793031D40BD8AD510EE109753DC1EEAB452AD9E822EA56E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.Storage.PersistentMemory.Management.Commands.pdb

HFkiller_full/ps/Modules/PersistentMemory/PersistentMemory.psd1

SHA256 8f91fa7d187548a9053d99275b4f9b39491627c8facdb6f4ead582c61f04f7f5
MD5 540bbc6c7c9c5e6f2409f3fe7f1abd56
SHA1 0651d6af2d9eb64e4f9da2251c6987ec52272088
SHA512 0461baa55b8398bdcfc2233e6296a13ae69ab668d2377c923e3a04a1aafb721cdfc7a0ea76cb67fe18ced77729c2db46da5ffd31dc5cc0205b069dbc6012b401
TLSH
T18821CBA142FE304B263E6343F5A0E429A7E487F302759B10B43BC5495BE2EA4D3D5878
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PersistentMemory/PmemDisk.ps1xml

SHA256 ae224999119a7e47931bed30caaad6c2a04bbfe9e66717b1b1e5508a1c81f96a
MD5 cd8a21e80bdfb5442525e27d18d34767
SHA1 f958b659382338b5b15b6d465049b2080883a96b
SHA512 04bc7f6b1f6db953e3653a1997122c9dca0247a76d452f232bc75a7a90a2a36a9340287c4ffeb525e4f9d79ea124ca951fd8bd38f95c9c3db05fd0b2201aa4ce
TLSH
T138315E0B97C43AD10676889596FC653ACE24A04B1C3E7AB4B79D870B1FB6D164433A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PersistentMemory/PmemPhysicalDevice.ps1xml

SHA256 bf61fc60c2a7e82a5f913dfdb48157bfab5af3803348d02f3129e6fbcbe70f30
MD5 a63d14c4c6eea884028c7456ae8b80eb
SHA1 3a5cccbc084e0fe7d73f640909f0b3fe4370a7d9
SHA512 f75f884e702c7c552ea801af91d34c855790bb36b5a5a89301ecd8f463e48a76250f0baed100c84cc044f07cc5c20f98e0be922e1bebebcb72bd8ed5eae8ec7f
TLSH
T1AC41D10B53D43AD10676C9A696EC662ADE20600B1C2F7AB4B79D870B1FB9D064533E37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PersistentMemory/scmbridge.dll

IMPHASH f3ef5fe395b2e49878acba952e890d84
SHA256 db20f93a23b49c3bff3660f0434d06ff9934da212b68ff966adff35dde923fa9
MD5 010182c3a1541b5d7fdd3634e6c1ac99
SHA1 f5ba44b082f8046dda287a3442e70a687a81aa9d
SHA512 df3982b6f8b86eb7d22893642977b00bb2dec473125c1dd41fa9deb0beca2082c25b6cda7606ec1f9df28add6b7eaf8038a252817a6f7563bbdba9b588fea759
SSDEEP 3072:y98XxQjImcypsvXVRzUyw5i4iCke9Fe0qOFa7iVmaKwK7B7Sf+12zNnkCWA8mn:y2hZmc6EUo4Vkem0qOFa7mi7Befe9
TLSH
T116F3192E7F7C10A9E076D13D89839646F772706A0B724BDB0291923D0F277E85E3DA16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

96752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

scmbridge.pdb

msvcp_win

?uncaught_exception@std@@YA_NXZ ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z ?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ ?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z ??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z ??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configure_narrow_argv _o__crt_atexit _o__errno _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__purecall _o__register_onexit_function _o__seh_filter_dll memmove _o__wcsicmp _o_free _o_malloc _o_strcpy_s _o_terminate _o_wcscpy_s __C_specific_handler _CxxThrowException _o___stdio_common_vswprintf _o___stdio_common_vsnprintf_s _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy __std_terminate __CxxFrameHandler3 memcmp memcpy __std_type_info_compare

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA GetModuleHandleExW GetModuleHandleW DisableThreadLibraryCalls GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx ReleaseMutex WaitForSingleObject ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId TerminateProcess GetCurrentProcessId GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

cfgmgr32

CM_Get_Device_Interface_ListW CM_Locate_DevNodeW CM_Disable_DevNode CM_Enable_DevNode CM_Get_Device_Interface_List_SizeW CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Query_And_Remove_SubTreeW CM_Reenumerate_DevNode CM_Get_Device_Interface_PropertyW CM_Get_DevNode_PropertyW

rpcrt4

UuidCreate

ntdll

RtlClearBit RtlSetBits RtlInitializeBitMap RtlSetBit

api-ms-win-core-registry-l1-1-0

RegSetValueExW RegFlushKey RegCreateKeyExW RegCloseKey

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

FindFirstVolumeW CreateFileW FindVolumeClose FindNextVolumeW

HFkiller_full/ps/Modules/PersistentMemory/zh-HANS/Microsoft.Storage.PersistentMemory.Management.Commands.Resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3bb734131a204474d0e9bd83309ee40db67700b948222eb9db76a5ef0220e03c
MD5 f39455ba72eaf497223ddf0da428dc80
SHA1 91c45618fe4d4c6257651efd98cb23e85bd2f3a0
SHA512 22f09d969fdefe372b845a7c2d92ac7c9455490757aab560e55016369e5af04fc9e59564c516fcef4a01f1e334d2daf273cb2ad15d138bd9fbef91fd32b1725b
SSDEEP 96:x6ehIJ+2HrT45oH0O6URy3P4kHekf/Btn1TpiWBXzPXGW:xOJ+2LT45or6Wy3P4HA6W1+W
TLSH
T119C12F1293FC0699F0F31EB446B64A659877BD15DE31C66E4834202E6D71AA0ECB0B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/PnpDevice/PnpDevice.Format.ps1xml

SHA256 47e2dd726147db239d5ad7a9d8086520fd08e7eb72bdb00cf7ffec167852e3da
MD5 a1804af921a7833e616bf7b59c4b137d
SHA1 caba6512cd7780e691d83eb9ae4a8cf11405c887
SHA512 c78e13ffe008c87870ad6ccf65ef64011d5d835590573e8fbddb95602cfadfe626c91eb00dd37c13b51b3c8bac3245a7816236500686c5d4de32c7dae54eaddb
TLSH
T19961C60B53D47DD20576845696AC56EACE21615B0C6F3AA0B7DCB30B1FBED068233937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PnpDevice/PnpDevice.Resource.psd1

SHA256 fd25bfc46114fd9095d6f804517212dbf83cd2d146e46403f88b524f135e46c1
MD5 a37b5b46aef9e5a0c1283ba860cba459
SHA1 274630b18fc86d9cf627923437204f7d1b3f8ee3
SHA512 57ec38a0362d4ba5baa93f4f6234281a80a24539d6c8d6a51cb37d85310a4869570e85eadb3a8b91fc816e67223a50d98f99291b8e116b5d86a365c2c0c4be0e
SSDEEP 96:bDAbDI7bmaUD3W8D+6UK68qaZqP3FUaCfL4yHi1Umry9Q/ui8Ntl+r0xK2:wbDI7NUD3W8k8Ty3r8Hi1Umry98u9fp
TLSH
T11CF10E2E1345563AE7334262781B951BEE3711BE0D3702B036BDB01EAFA95D1839BDD2
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PnpDevice/PnpDevice.Types.ps1xml

SHA256 026eb2d0d6aaea86962c64d09eee104ab330815a009568f464b44b81847c55db
MD5 7da197cbfe10789cd7792638f86b50f0
SHA1 6a371cb693b21096dde9eeab31bf726030811340
SHA512 25a22d1488ed141d45468a1b31122af37fe678622123c87e6749817de0d9f173d0ae56a225e6328fd6671924ee7b3834016fd798532ada430d780e7d0585db12
SSDEEP 96:pxd34h+DqXCdqb43465BHgyERcv3McewjUi9Aq1b:VA43465BHgyERc0cewjjb
TLSH
T17962360F12DE0179E5EE6133456B80CAE82271FF85BA827436DE74686B748C8565BF33
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PnpDevice/PnpDevice.cdxml

SHA256 238b5fe30d5cbfba5888ed8b90d2c393a20f05fdc20e6d58b741b2496ce3d1cf
MD5 2a21939e22ce06dd3a739cb7eb66dea4
SHA1 ee1d8f2364babf970d7f55f62c966bca147a4502
SHA512 f51db2ffa651bac6fedd60ed0c9b9f8d46707fa576d2250134eb61d4d3df7b2e6dc34c06626e2620a1d776e2883b9f5c1af14843f963bed354018e9910c41a0d
SSDEEP 384:sDFDYDDPB7ljdljjEDRtja16u6D1EIMgGN:Dg6
TLSH
T1484258401FC4AEB682B60D285936B599DD3885B3533C0458F2EF3A275F378812A6F167
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PnpDevice/PnpDevice.psd1

SHA256 c686be39cb5c251cf6af83fe0ee613ea15723e23dfd9df011d435a11a0b8627b
MD5 f77a10c90507e5c076157be0b1656fa5
SHA1 891ac64bdb54a539bfd834b940a9e9d32424c7a8
SHA512 631c09e38582f93922fc58466144756bd4dc207e87164b5c1d2504479283b9234c904e071a9de467aa45b74147d723ecdb2bb057ce4988813f018eb804a17287
TLSH
T1A7116BAB9A1A849751BBC213A8440C08E76C8BF74136975279EC8A440FF2E8383C9B74
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_3DPrinter.format.ps1xml

SHA256 cce9b9ba02595f8cc2c2b370f3da12bace94b5f122221bb6b108635beb548a0e
MD5 fe171e6f386aa46d47c681d60969500b
SHA1 6c41ef14ab45ba52b6419acfaedc1d0ffa9926ad
SHA512 8185a9aa3c6190f45976f7a50a32741b08f8a9e7aa923a4f969c479898267d32936405abc8584567c54990f85ab98e110283d6a6c2b9c28f5739ea1dcbc0a4b7
SSDEEP 24:2dFXHPxWr2MwCORgRwaG9pPTrIFW3rtnFyF3iL6:cJHZWrogSZnIs3rtngH
TLSH
T15BB1030FA7C43ED52DB58019BAA8B525DE51621B4C3E2960F7AC471B2FF2CA5413363B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_3DPrinter_v1.0.cdxml

SHA256 08a11cd3a4b17dadf03953d43d510f986aa82793e91b5f4f438f800e7ba0e00e
MD5 09e388d6f063cbae59f5dd246e483fa9
SHA1 90bd8f81846d7a1e1770963addc7f699b92800cd
SHA512 2916852821815d6db149027394734dee1056bab1cc1ec6a50785b6faa0028c4501bee701b832a00ad7f1ceca2f783d33aefdfd621351e3bcdb98a730e6de440c
TLSH
T1D3D02B5169C99DC2C577E15C51E5CC44F34533CFC1BCAD88FA60BE0A0A9208AD00B378
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_LocalPrinterPort.format.ps1xml

SHA256 655ac8125376791fd7c2321d46a483ea54bbac303a9a686b3aa6561337bbcfc6
MD5 a8a85c9cf95f736fd928a351493ebed8
SHA1 f780bfde5a17de0fdde8eabea61c007e03d32d5a
SHA512 694f5c12977fb62a4b98a6f6dc18faec826b812b210622317550bf1282153c1341f921f260df35bf6bfce118f37c1e4284b875b55000e27568a7942bb7a85473
TLSH
T16C41160B92C13AD209B58516BBF85569EE11B20B0C6F2960F7EC471B2FF2CA54133A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_LocalPrinterPort_v1.0.cdxml

SHA256 87d4225e8793a4724303873146257533036f5bc0a334a788cded0a7d0a7a5eb1
MD5 a1a96482262605d464029884638b8c93
SHA1 1c0407ec9f63ac3f43971ec1b2ec127aac52e7dd
SHA512 507a7529d2313fbfeb05a764b5000a80cf4ce7b3d213b3287b47c0d2d60ed862dc60c5e879bd010dbd335d1c879ea89dbd65a72001536bc0c1fe000338e761d8
TLSH
T1D9E0CD5155C69DD3C56AD25C51E9CC44F345334FC1B85D44B665AD061BD1089904B738
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_LprPrinterPort.format.ps1xml

SHA256 718b001c655a8e1400b5da9729f9f32f43533707b89aa840e6f1da49d350135d
MD5 a1557f204b7e407de419d5ac8584d095
SHA1 82e1c57bd3438dca4e84ada3bb601e80f1fdacb1
SHA512 47c5c92d834abb2a319347468135722e1464cd7eca7c7448584629485ac8bdd890c94f015d04777ada7589008883ef038d41ca0d2b8ceaadb7842b7681f56707
TLSH
T19B41040B96C13AD109B5851ABBF86529EE11A20B0C7F2560F6EC471B2FF2CA54133A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_LprPrinterPort_v1.0.cdxml

SHA256 6ecfd6a2f8000b34afc6c2f7a26147d5a8d2e930bb2aa1d516ff102be6a86b2e
MD5 4f3ad82834cab8840fd4a1fe6ee70c6d
SHA1 df16ebd0ba16406b94d8736a0e4fbedc19c4b64e
SHA512 f8c46a5c043f299eb1e5e05b65eab14bedbdb0d0c37e84190769b75890d813955fe8436d235ddccbf7e980b705d9acf9146a1bb3b9a350fdec41b8cca6aac0a0
TLSH
T1D8E0CD5195C59DD3C57AD25C51E9CC48F345334FC1B89D45B554BD051BD1089904B738
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrintJob.format.ps1xml

SHA256 016aaafcca7368033f0c29b5efff36fd066eda1fc9b1a3c580945e7dbe2278a5
MD5 31690e8bf6c1acebcad2b0350759f897
SHA1 5c26fe826820391ec5aec2f72be6508f472e4b84
SHA512 cd865021ad05cd72732243b728209fb4d3320c9d49bab85ca01256eda2b48814776784c244394c6a19b7204c51375b245637ea380d07b2c483d00eacbfa56b46
SSDEEP 24:JdW5HPxPJ+OQJZ3QS4MGebrPxP+0cFm9c:3W5Hpx+OQjQStbrpTcIO
TLSH
T10891BD0BA7D07AD159B5801ABAB8B525DE11621B4C3E2960F3DC470B3FF2DA5413363B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrintJob.types.ps1xml

SHA256 f02e5009294f69f0b463696ec1bece35e38bf04c8dce0a997e2555743f0f1d6d
MD5 8f884bc9f9ce16c77d524f4a1c284034
SHA1 dfb27afa0d6228a6e316aa2a6b14d5a1f6c2a605
SHA512 9f2649706c1e74ac416ceb72b249d95db73ec8b1725b324d078660ab5ff1b1ca20faec5b19c6066600e0901c0e9546b6646d4a66e0a19af815035181aa3a7bbe
TLSH
T1E701D261F2FCC49089B8500BBE2AE855DE1251AF407F92AD719C4E436B349C8DAD3979
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrintJob_v1.0.cdxml

SHA256 197bf166d3e73d0708c432df38d355b4869a0dd536650ae6f42a00319c6e3374
MD5 33535d24a7b5c8d57a08938adc5e67a0
SHA1 af553b67389dd0464d7c930795a797cc6a5a84d5
SHA512 699d0ef8a9c02a44ac57041df050c1778d743c1270bfa96f7d668d4f9bb105bf542f81f39967a6f37b1686a3e4a7b136cdf1ca88b43b7fc4153ea2ff35419fe9
SSDEEP 384:ODdDtDOIDt0DnJDkDtDnuDC6DnzDkDtDnWDCmDnhD5DADnWDC1DnaDkDtDnwDCXa:R
TLSH
T12782641273C65BE081B4505965A5E8A1CD7E52C372AC4804B0CF3E07AF3BEA6F6B3716
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_Printer.format.ps1xml

SHA256 59001b48956aa379378209c2101d249349e2c7c0c28836926c1d95d822b71709
MD5 67dbaed61df5cd5233da22e9f88689a5
SHA1 ea397794f3ee98b49b89e0f00a93d8cd628c071d
SHA512 36737a5ef63e1e3cb1bfa9ffde43ccb9c48679feddeadc852ae8beb918dbc4b9d971bddb08509f5cbc2a3944d90445117d8f607563c2126df58cf17f4caade61
SSDEEP 24:JdActLOPtPxWr2MwCORgRwaGYpPurIFWVg9rt2n+FyF3ZzViL6:3RgVZWrogSUWIsOrtM+grv
TLSH
T126D1140FA6C43E956DF58019BAA8B525DE11620B4C7E2560F3AC4B1B3FF2CA5413363B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_Printer.types.ps1xml

SHA256 296a94e270b11bcec87e143bbf4fbb8ad490c2bec3944f549c2be5b12d7639ef
MD5 2d71e4715dc7c8c1c4c4edd00b240c39
SHA1 a94783f26bcb581e25d7ccf2796250124e42c12f
SHA512 78f30a36643dbd006f098ae6ca0c37f21d59f6885712a58fbef375bab54d46e5e08d9265721b0a72c9997971c5c1350c7fcaa8d57b6e2d78cf3ed49759b821c4
TLSH
T130312970E9A9CC9489A9501BFE36F859CD02005B803FA1A4725C4F873B2D895E797B36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterConfiguration.format.ps1xml

SHA256 bfc587c5239252cbffc62c45985c8664f0ddc55bd76e5ca758ba48e17b870771
MD5 f9e1810ac259a8ce49677183595a2f1d
SHA1 cd3efb7bc2cbe545bc4cf70d5358cc766b6358a9
SHA512 eb9bec30b1ab5dea8af6e0ddec5040bfc5933a9b92bc5e365b8abce2b629dda4f318f7a4f55f10f20f3f73545c0689d685fc344aedce6e1a39abad066e0a0e2e
TLSH
T17A61060B97D07AD159B1812ABAE86529DE21724B0C7E2960F7EC470B2FF2D654133A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterConfiguration.types.ps1xml

SHA256 6219f5647f5eeadac3faf14c3be37c94070077f0881a2189f8f115001a4ba18f
MD5 3be9561e21994375f44e84c79dd94681
SHA1 3b8539bc79252e5675d02c94ab5abfd78b9cb40c
SHA512 163f64ada3a997115de6c0d7dd96de8e6d12d8dcdd1d57348cca445fe4e3222a0e2c4e3173188751686c9dcf04392c7a39ead96957ee8f40a93c0f6e7674d24a
TLSH
T1FA216BA1FEBD8DE081B50247AA71F91DCE21015BC03FA1E6723C5B473B2C854A757B26
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterConfiguration_v1.0.cdxml

SHA256 a06be7821e451af3bee29ea21a55cf13b5a807ce8c98cb495061875407231a19
MD5 faead6e4c0d4ade44fa9dd17e7df828e
SHA1 f4d7c9f02099bfd27d95b9ce4e610828328d2556
SHA512 03058d910a2b5d78b3f0770bac73aad95a0e41afa460914007a1150f9684b8e89a074dd1f38cf133203c5f4e3793badcfe9120beab379c5a6e2c0807e1951e24
SSDEEP 384:yDtDuvDulDUDwDRDyDCD5DncDUDwDRDyDgDnuDns3BZ:7
TLSH
T13E927A889ED09DB200B4097536F5A852CFBED9D3321C2496B1DF2D1B6FB7DA0A637181
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterDriver.format.ps1xml

SHA256 fed8b34f445524d263176cf6b473bbbd27e45082828769a6b29a05f122983e8d
MD5 4936dea10666c5f977c5790c5a06a316
SHA1 6ff3cbc21e813cae54ebdc78e502bb723afa69fb
SHA512 601f9600ee218bc6447ba5bdba70e540673ad49eb327a65a752b5505c6dfb94e440b418fd88b1988b6f219f8adb83e13fa558491b3d7ae42bff39dfea613dae9
SSDEEP 24:JdJz5HPZzExf3OOFCRCyUiGGz/PZzExBrQKiyFaEBxArK6L6:3J1HBK3OOFMLJDBytrQa/
TLSH
T133A1E80FA6C02E952DF18519BAA8B635EE51630B9C7A1450F39C4B0B3FF2DA5413363B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterDriver_v1.0.cdxml

SHA256 bbde456aa0d5748e4d307600863f1a42b63101936723c7c9ffa661b8fcf527d8
MD5 3fefa62ba2706cb86bf044b1d9c527db
SHA1 bd7c167deb515e5e14851366a291753c68eed82a
SHA512 f6c0547a8e584a072cb7181083f320e02c03eb6e5776ee46e8d38c5b182d9f3c71bc4bd442096bfa8b8636648adb88f5972dcb5cbfdf799ff595614c6e28f3e7
SSDEEP 96:mYEDhM/z0Y0kTxPMvDz1DuqlD4UDBDUDnx:1zjZTgDhDhDtDBDUDnx
TLSH
T15591235463C11EC446F44128A2B2E8B1EEA957D3B1791411B2CF7F0B4F3BCA9B463726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterNfcTag.format.ps1xml

SHA256 bec21af9ab592094cd0dac559cd07208150b91e7b5c76272763e6f04bcff7199
MD5 e5edc97d01bbab5419c9004c7ca483ec
SHA1 4f366fa4dfa7dedc0277f543fe7faad620a2b405
SHA512 0d8bc9322da854c4eb043620fb8d3e95098affaf8ca03d3b88c5d911ecf262148e32e23b7ed0cd2e8da07299129285a6cdb1db1fb55923079aa0d3f799035b03
TLSH
T1C041660B93C07AD189B1855ABBE85529EF15720B0C2F2570F69C470B2FF2D694233A36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterNfcTagTasks_v1.0.cdxml

SHA256 a644f0539a7c33d102d9ef62f8a853101fb4db31e8dbcb89db41095c2553f0e1
MD5 6d21552e767eae8fc43bc189fa15f488
SHA1 a19abbfcc1c29d293d74b6eb02dfb753d647a335
SHA512 2853940bc6dc8a98a0224a00d15c37a612fcee9b48ab910a0b799d372aa62f13a3e02625f9dd43c5cf48f34519f992835781d74acc85e85713d1da9e86cf4386
TLSH
T18F61462173C59BD045B2905D61A5E8A0DD7922D370AC084474CF3F0B9F3BDAAF9A3B16
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterNfcTag_v1.0.cdxml

SHA256 19872ed930eabb23cc924ee57f2eab769ee74b7e95f62b3d44b293319820fa71
MD5 73b7216deb089c58da751387c2b4c506
SHA1 162e3054eec751f91dad27f1453c470d10627940
SHA512 79d4da5c1f93930654b86423b056d78f589054fcfe2337da4871d4183a5d3733e5fd2a7b8d946d392f6d4baca0e45d11862643b53023056734c572d94a3a7891
TLSH
T10FE07221A8C4DE828967E25C20E4CC44F341338FC0A8AC88F660AE450E8208A840B33C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterPort.format.ps1xml

SHA256 514fd8c7b902d0328ff44777a7c45df2a46b49bf5e44a22907fe9c364e0e646f
MD5 2907d02e8fafbad020c5fe79433f1353
SHA1 37420473b558dac6ccbc7c0a2d892454028a35b9
SHA512 cfa4d16dba3d3c1ac6e47301058079ac54c9f9878e4561407ca9876e55b9922e9cf638fa11b45739e82da83255302b595bae415ae587a1c7142acb5c7d61ab4b
TLSH
T176414C0B63D175D24675C516AAFC081DDF22718B086E7A60F2DC4B1B2FB294A4237E37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterPortTasks_v1.0.cdxml

SHA256 266b4ce4b9533a4372f7fd528a2e3eb1c55206ac484b5bdcead1b245d9421030
MD5 76618ba23168a11ce900c8cbf1f1bbf2
SHA1 e536cb46cb4f3888264be24b8d6705c00a813fea
SHA512 226e585f97f42974824793c341110376b87bc854b13edd0153e2aece0f49833e0641c973b98c116168d86fc0ad412babc90b2e0f97d6049bf76bdd959750d556
SSDEEP 192:7DcDngDiDcDnyIDAODiDdDNDwDndDiODt+DnDdDNDwDnx:7DcDngDiDcDnyIDAODiDdDNDwDndDiOR
TLSH
T167E1DC6563C21BC842B554A821A2E8A0DDBE12D3306D5444B4CF3E078F3BEE8F563B29
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterPort_v1.0.cdxml

SHA256 c969e064f82b151f82ef83143658aec143f23596fa9f5ac1e2dcdf5b38ea83c0
MD5 9f1cbab62313fb78c08cbcc4117c35bc
SHA1 7b409f4ee23962ec7d5d4cbf1e9c8d65858ddab2
SHA512 104184d74d4a234d4fd8464188cb6da244004193fe6be692d792fb1c40055f197dbdb5fb3fbb08587d78b35a622a68f8841b1f6634d6f91bbc636c36d43c2e76
TLSH
T16F416A1053C11EC445F58129D2B5F8A1EEA9A693A1391412F2CF7F0B1F37C99B463736
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterProperty.format.ps1xml

SHA256 4870d589e7688b1a0df158de7521dc10a9e7c191b47c01b50b5a3b3d432bf395
MD5 62c5b73a1bba9218a164438db366833c
SHA1 db2091f6b653f42975ce7f111c17044133b92b22
SHA512 551439bc5e50e78fcfd50ec72fcff4d139e344827bc6e25567689eadf755ae9c3a05a759604494c0c0e5a91d10fb29149584efe16ee21085dc56efe32c7fe7a4
TLSH
T1F951EF0B97C07AD109B18519BAB86929DE11A21B1C7F2960F7AC471B2FF2D654133A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterProperty.types.ps1xml

SHA256 4a160259294e48439fe9a9b66b92810bc704e9e6018d20e41c13761dc7f4e614
MD5 bfdba59bb52f53bcaaa035dd560f96a9
SHA1 39ca41d07d95e89dd2eb61319aa4a841e3e1895a
SHA512 f74834eceec8b957c92e38b6aa9b50f866f16f6b2bb81ec51c975abcef13c3839cbbac9d70bc1e028a1846747481d7c498b65f0757a886c550a9e446b40897f5
TLSH
T1B9F0E510B2EDC85085B45217B935FC55DA01518B407B9168729C4F032B248C8D697B3A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_PrinterProperty_v1.0.cdxml

SHA256 a67cd064180b8715bbeb242ec78524da95772a6eb9ff08a128c41ff750778107
MD5 faa980ea7fc9f5435dbb5459cae24930
SHA1 2404f903ef5fffd5204aaefebd4b6b1660327622
SHA512 4e42304b2ea95bb2c4938f34860d6e43e040858d91c054c1b9449a3fdcd86336b9f65828d57c18905e7736e5cb87b451b959f83fe0a3dc19787aa4c83acb18a3
SSDEEP 96:mYEgcM/zNbkzhLK8DClDneDaDDnTKExDClDneDn5KqKHDnG8e7:/zyzVDSDeDyDnDDSDeDndYDnGj7
TLSH
T195D12F1163C14EE045F4516861B1F8A0DEBA42D3B1B84801B2DF3F07AF3BEA5B5A7726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_Printer_v1.0.cdxml

SHA256 d8aed9ad0907527976050996a74e012f27cf74a72185ca3cfc30127f00e84f9c
MD5 7ee74d0effd115c4b49900477a9fd2de
SHA1 43f0e00bf5088ac8416c1faaead07910428ada64
SHA512 cf3f8e2fef8b774869b2f572491e26708253dfda4ba6b4442a106f36bce77e3b5993e7a1f39753784bb586954b57ae89ffecf53c7782a2a0d56946a89b96291d
SSDEEP 384:nzhzBZT9DGDdDRDeDFDyDNDD+DZDLDKEDCDNDDDXuT9DrD8DRD/DNPDcDnDuDhDp:QdxrDrF
TLSH
T11DC2DB6163C55BD842B0066865A2E8B4CDBE46E330AC0444B5CF3E079F3BDE5B677B26
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_TcpIpPrinterPort.format.ps1xml

SHA256 5f78d5ddc4343c01bedb64c97e35a83775b151b1927e8502da2c70b9aa8700cc
MD5 f15bb60345ec09930bcc222045d65d40
SHA1 599e1eff7c760480ac4a281dfaf20fda571fa7d4
SHA512 fd63bd2fec9644f90d4e9d77ff840efc4c63fbe72d884a6ac58804c3aaa500e76710ffa671e9f019c6b7fbf7b8aa373860d05ee3b391f8d7c6ac61adf8192d28
TLSH
T1AC719C0BA7C13ED119B58419BAE86539EE51620B4C7E2960F7EC470B2FF2CA54533A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_TcpIpPrinterPort.types.ps1xml

SHA256 1f2b002790792c5af32ea6f5aa2458de020a789dd57d848566e109c7fbd99691
MD5 9d85cce4c2b7bab3ab798bdeba10ab9a
SHA1 19dd59b3ae852130c8be432cc849f84600cc11ff
SHA512 4cf3c24e5fd871eebe1294ad3c74ff9334d5fa361b03c29025c5e2c6697a59654db9d7bab1831e94547a808fafbc73088e4fd0810b68423bd645ce752aa25a7b
TLSH
T1F2F0E510F2FE89C086B85017BA35FC56CA09929BC07B9669719C4F032B24DC8A693A35
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_TcpIpPrinterPort_v1.0.cdxml

SHA256 24ec3a5f5c37a3972b17faf6ef826becc16d8f0946ab0d966a8e788e297302d1
MD5 0850e646e3863b759e22d71974bb4f36
SHA1 6dc5a436ca89fbcac11b4184fa36cef302cb124b
SHA512 35c8430c7ec4aa4e33cf11bf3688ce9ce8189de90898a81410e02ec16e7e37b349f7a46918cdfc78663949ecc6dbb621716593af54e1453a8ad66f662082858f
TLSH
T1BDF0970068C59C9282B9C358A0EAEC08FBE5B29BC15C5C48F0297F131BE2095440F3B4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_WsdPrinterPort.format.ps1xml

SHA256 330f1e90d5309dfa00bb70253736ea604666ba01dae9cf1249cf6011ef61227d
MD5 f3227ba1f9d2d27da53be1b443b5b7fb
SHA1 028fac13e455d10da71c957aef969d311cc94c5e
SHA512 c03ed7fb387a3bcd6b34a3b0b6a504b75f1f9041bd8185c637be22fceaefdae70abcc7f804c29186bb515432c68dfd0d34722d577b738bae65507803a7080dd3
TLSH
T1EF51D60B96C17AD119B5C519BBB8A529DE11620B4C3E6960F7EC470B3FF2C954133A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_WsdPrinterPort.types.ps1xml

SHA256 640571d221e1f276a9287e012d1ff5295d062b2e1757b5129d803775f664622d
MD5 d9529e2ba07ed867a27d0df06775907b
SHA1 68812804e5d113d3b25cad2c52d186c8bae29045
SHA512 b383e6a9d14ed7a1b873c621d0f98356bb9dfb49326bce770bc9ddf04ac4dcbc86844633a8a0086a467b7cc4c09431810568d7cce4a6c9c6b5b0f7482602f2cc
TLSH
T1E9F0A751B5EFC98045B8912BEE39E855DB01919BC07B959875DC0E433F244849693E39
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/MSFT_WsdPrinterPort_v1.0.cdxml

SHA256 6d4bd62b43f1b38de3394d94c502131d3996d98199e4de06e7e01852b2b72625
MD5 24e9a779813fcc765b4ca96923a51ef7
SHA1 ecbe6f7f1f2ac671fcdf0d1f7bc959897cc62395
SHA512 44e91ef8bb56a1e657ce5c33658b1e3dd604f69850fbf8700098ac9c3922f7f920b26c77099b800069b56f956ea8ce8185c02e5938ca45b0696d94c498b78350
TLSH
T1DDF00E052CC68C9282BACB1895F9E808F790B187C12C0C8CF1283F132FD2040844F7B0
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/PrintManagement/PrintManagement.psd1

SHA256 05a7951e714c041e6d94562356da5bd772f8aa491b7fe3258231ac91c2066f3e
MD5 59aa86aa1aa1563eb3f3c2df0aa9ffd3
SHA1 260471924930a087de6342aad907e3469569317b
SHA512 040c76721c76f57984413f5d831608d16e0005f5bb67ad53802d083acf3372c3aafb8bf46a022db5c313bea8399a8c8cccf29172429d4a70fd821ec36fabf7cd
SSDEEP 96:RSbHRgN8RfA4F52RPfOnYOPN2om44EOxPWUPPOPOPDPeP0fGfEf7Kf/OWWIJJuIy:MHW8Ro4F5ItE4E5WIuKVeTd
TLSH
T1F9028C02E3FF4900F9F66F9469B151704BB77A99AD3DDA5E019CA14C0BF3D2084A1BA3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.dll

SHA256 58d6c2fc6d2e4140d17a91de703220041f2d7178cfc8b1122f80c5d681f98d0e
MD5 8f29a4fc699b20ceb3948250db44cbfd
SHA1 3cdb7ef109c52da551545dbbac8178be3301ddc5
SHA512 02da1dac96ca9b47aefdeeecf46e4882785d5d87c0cf53b13b03a434e258734eb33897f57b024e757357b5e5826dffa70084ee515d29a8ef0259789c51b66ae5
SSDEEP 1536:v8SWYXArGJh4ibJPFzS8u3wSV9o72DPGt7U+K+t0uHjefpUeT56zb:v8SWiQGJhvPFzFujV97476uHjefpUetI
TLSH
T17493191577F88219F7FF4B38A9B147110AF3FE466836EA5C0C8891CD0E3A7429616B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.ProcessMitigations.Commands.pdb

HFkiller_full/ps/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.dll-Help.xml

SHA256 007846b94154c81689ff02990d0cbac0a07c77f33a9cbc4cb43adb88f8ce0139
MD5 0811a27b408839e61d028d5a56815796
SHA1 b28b487d72f7303bb9d441e5ac012732d86a9be8
SHA512 bbaa526c0cdd0cdc77fe1d5b7139178b6556813dfd5bd712a0fb974f4e45cd6f7f9b4e3774b0d1a219534e99c034c014e52cc6c01c4e5a06a15a79bcbb6117fe
SSDEEP 1536:Xp35rtQ8QwQDQGQoQwQxQkbQyQNQ6QwQyQ+QwFQNQDFQwQyQfQpQ1rQ4QrQNQEQT:XLtQ8QwQDQGQoQwQxQkbQyQNQ6QwQyQk
TLSH
T159238B0D67FCFE4A2541E134348D8078803BA791F61AD2A6E0B4FF5724D6CF4A6A7798
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.ps1xml

SHA256 bdeb83831291127da9156ba41e31c7cd4cdf1b5666959e201e70fea822f93336
MD5 1408a285939ac3e50474f8df249e30b4
SHA1 26a7709188ca2af57d688ec082cef18f56879de2
SHA512 7bbca59a3f8351e75bd132700492d944b9371337416b165a00d913da39591f1a21b692b9443d5ca5d8a79124ba62d7e0501b9bfba89c25725af40cdd867078b9
SSDEEP 192:8VxI9IHYNgX2R+1XIuyHYAVBgVQrikiL5kBnOls9HSN6OuhwtrV93pdVwvGTHbFr:2EBu/FRRw/F0
TLSH
T1E223092573F45BB409F04067F2B86C12DE1E9AA719B04296FB9D17371BE28227CA3537
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ProcessMitigations/ProcessMitigations.psd1

SHA256 e4089d0bc3f09baf29205fb14615fae3ac9de3f6741bba7f2a2512a48c54c318
MD5 2a3a4fdcbfc064612cec1c4a14a7bfb6
SHA1 415671faafde193dc32acafedfd340544a81fc88
SHA512 77f4e8820de67549225f96bbb9c14ae379beeae066c674c5a74bfc8b10064d9e4bdd7b9bf016fd46e1c171009387e95af83047107e64f51b43b173b78e16a5c9
TLSH
T1B1F0D3FE211C8413C49EAD53F100C117BEBC57BB143BD671E869D84D430A965C3A32A4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Provisioning/provautologger_add.reg

SHA256 451aaf39c7bf952b9006f4782d9a4972e70fd95f1a0c2597c6e2fd65df27bf01
MD5 32d37f09a6e129244e643c59cbf956d7
SHA1 86ee36efc00c4e54ed780284deba7b16b8cd9b3d
SHA512 a2dce255b481ea3c0b88af48e4220446787f12586283956f35e66ea3594f1c589ab77871ba3abffc3fd514f3cac2c7ee7fa1ba3b5b49c1b974dfa888bbf3dd47
SSDEEP 48:9JDpLzMLkT1ihTkib8iC4iliC0iOiGS0KuiFiPiOSTihikilicY+UEiNikxihPij:PeLkquQ+Zy1DFMNVjo
TLSH
T1D5D1A93A4CA2C3DFCB19B0157786F9D33974B9A659CA9D6600EC649238C3D63C09AC4F
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Provisioning/provautologger_del.reg

SHA256 3bdc2df1b8f05636fb82ccdf9924f7adae0d085adb5f8968114ff31c36f968e9
MD5 890c68d94b70434b8a571dd12f98608d
SHA1 568f12b6cbf7a4b400180c21c657fc9a44ab811c
SHA512 575dd8b3b31680723d8a5c7b49f891fa4b9422500ee33cd445bd1f67f100b3d237b6ce08b00821ccea56bc8551c50159ed172fb6ee9fc7482d2d6ae87bbc31cd
TLSH
T1D7C09B9F0C230315575950056B508E923475F754F957D51638D877C335C24C7456B06F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Provisioning/provcmdlets.dll

SHA256 38b4a27407de5d06a376623f00a0e306ad73e59abd39510f2b8c122f232f55b6
MD5 2abf5df8dcddec55c3f084a8390d73f5
SHA1 c555837d0473b4212c28dca9cc8d017bbe369d9f
SHA512 b45c0db3e52d3b46cff5959fa1469252821db0d52e1c8e485d40baffe954dd53cc999410320f4a8f4d6b44e74af2d060935844a642939302b06c6805ebc28e06
SSDEEP 384:bKk8lpOV8txiz9d02U2E6ur7QITxyz+l0F04zev5lE/ylOp9n0WdE0fW:bKkqu8tYhU2QrstIt4MrEqlOpFE
TLSH
T16692E80093ECCBAEEA9F077CA8611621027DFA477562DB9E89D537863E177C825107A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ProvCmdlets.pdb

HFkiller_full/ps/Modules/Provisioning/provcommon.dll

SHA256 ea69691bd4988aa16d737f95db1cf171488e0d753510dac45ad864813f563bee
MD5 6e6b69d1110c22e4363c7c9324318917
SHA1 e47fecfe1f95f478b94b9d655c78ef02cbf505a3
SHA512 e9e11e854f1478490e7662904d2458c752139d8c5466ccf096887664fceb8d836294525994426f7435321de715a55466484a3f4f29b33df82d4a5ff806a7e3e0
SSDEEP 1536:dIAyQj93rNPaiUowLQITTg1saajvIumslbR3/d5hptk9974Cq21HSl:dUQj93rnUVg1s52IbR3/d5hptk9974Cs
TLSH
T13E934C187BFC4A06EAFF1F79F9B852005671F88B6121E74DA84965DE0F32BC094617A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ProvCommon.pdb

HFkiller_full/ps/Modules/Provisioning/provisioning.psd1

SHA256 48e57a94339c5d509c0986db9c99882bc1aa92b3029eaa002c9131e3902871cb
MD5 bc3f4977d88defec2ab511fe340c2b4a
SHA1 2e5e182a53892fdc5486e4fd776558171c9a5770
SHA512 680a0d25af41790a0fe1c0b9f5ae607e99991a9258ac710d5c160a3659e0ec1437b4d474baa5d99f15b2c7f61f110d11a3134148bc9f567870e8b49cb798fbfe
TLSH
T1CE41F603A7FB8904F5F20B58997A48744A37BD9D1D38C91E028CA44D6FF394198B1BB3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Provisioning/provisioning.psm1

SHA256 5ecf95edb08cd5ad933c60f7b4499493ab75cd9685f537cc7640d0eb9b20768a
MD5 816069a0c9623ad529679eee809a100c
SHA1 072d681168eacad1024730925456836458f222f6
SHA512 aad9cfcd62bf33d1b1210de42a9a456fcecb0cfdc6ccdb8efdb3cce897aa3639b26c1873eb443031068cdcef619391b55b57ff34c688a760424a487978187afb
TLSH
T1EDF0E924D2916CEFAF2C177775E34867082CF71109B22D0026CA43E835C3B64112E98E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Provisioning/provpackageapi.dll

IMPHASH 5ed3c459e80861b4d2086a27b6aa1c79
SHA256 8d9425a139d21c30038b03d6e4348f36bbeb11983fdcdbac29114062f707c6ce
MD5 a5ee37f8041244c0564daf6afc4e7d09
SHA1 c4818cd8285ea17569a2c3a20ae8132020cac5bf
SHA512 d173bb9e8359e70921f3500ae56eb900cbce7700f11c1e1e545a8d7951458b5caf98f962f4a4e5e7160d1d9baf0adc4bb128b876a3173958afad86a8a067d723
SSDEEP 12288:50DVRJUCeXRa57lYedsEG5qnUWkDPwJoydf2s0AO3eetsH9AR5cIZ5MD6:56Vkk5xY0MY/7OOtpIU
TLSH
T140F46C1E63F800A9E4BBD635CA728556DAB2B43423319ACF1190C67D5F27BE09A3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

563514

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ProvPackageAPI.pdb

msvcrt

__badioinfo __pioinfo _iob _fileno mbtowc __mb_cur_max memset memcpy memcmp _XcptFilter _amsg_exit free _read ungetc calloc abort _lseeki64 _write _isatty realloc wctomb _snprintf _itoa ferror isleadbyte iswalpha wcsncmp _wcsnicmp _wcstoi64 _strnicmp _wcslwr _wcsrev qsort towupper towlower _wcsupr bsearch iswspace _purecall iswctype isdigit localeconv isxdigit wcsrchr wcschr wcstombs_s wcstombs ??0exception@@QEAA@AEBQEBD@Z ?what@exception@@UEBAPEBDXZ wcstoul _wcsicmp _vscwprintf ??0exception@@QEAA@AEBV0@@Z ??0exception@@QEAA@XZ ??1exception@@UEAA@XZ _vsnwprintf __CxxFrameHandler3 _callnewh memmove _CxxThrowException ?terminate@@YAXXZ _cexit malloc _initterm _onexit __dllonexit _unlock _lock ??1type_info@@UEAA@XZ ??3@YAXPEAX@Z __C_specific_handler _errno

kernel32

TlsAlloc LocalFileTimeToFileTime FreeLibrary LoadLibraryExW GetVolumeInformationByHandleW UnmapViewOfFile TlsFree CreateFileMappingW CreateThread SetEvent WaitForMultipleObjects GetPrivateProfileSectionW DuplicateHandle CopyFileExW OpenProcess TlsGetValue WaitForMultipleObjectsEx TlsSetValue ResetEvent MultiByteToWideChar MapViewOfFile DosDateTimeToFileTime GetCurrentDirectoryW SetLastError GetVersion GetLastError VirtualQuery GetProcAddress GetModuleHandleA SetFileTime GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter Sleep ExpandEnvironmentStringsW GetVolumePathNameW UnlockFileEx GetVolumeNameForVolumeMountPointW LoadLibraryW RtlPcToFileHeader GetModuleFileNameA HeapFree GetModuleHandleExW FormatMessageW HeapAlloc GetProcessHeap GetModuleHandleW DebugBreak CreateSemaphoreExW ReleaseSemaphore WaitForSingleObject ReleaseMutex OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CloseHandle CreateMutexExW IsDebuggerPresent ReadFile FindFirstFileW FindNextFileW WriteFile RemoveDirectoryW FindClose CreateFileW DeleteFileW LocalFree GetFileSize GetFileSizeEx CreateProcessW CreateDirectoryW GetTempPathW GetFileAttributesW SetFileAttributesW LocalAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess OutputDebugStringA GetHandleInformation SetFilePointerEx SetEndOfFile GetEnvironmentVariableW CompareStringW GetOverlappedResult EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlushFileBuffers SetFilePointer GetDriveTypeW GetSystemInfo GetFileInformationByHandle DeviceIoControl SetThreadIdealProcessor GetCurrentThread GetTempFileNameW InitializeCriticalSection HeapReAlloc GetFullPathNameW GetVolumeInformationW GetFinalPathNameByHandleW CreateEventW InitializeCriticalSectionAndSpinCount LockFileEx WideCharToMultiByte GetVolumePathNamesForVolumeNameW

mscoree

_CorDllMain CorBindToRuntimeEx

ole32

IIDFromString CoCreateGuid CoCreateInstance

bcrypt

BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptEncrypt BCryptDestroyKey BCryptGenRandom BCryptGenerateSymmetricKey BCryptHashData BCryptSetProperty BCryptCreateHash

cabinet

ord22 ord20 ord23

advapi32

RegQueryValueExW RegFlushKey RegLoadKeyW RegUnLoadKeyW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW ReadEncryptedFileRaw RevertToSelf CloseEncryptedFileRaw WriteEncryptedFileRaw OpenEncryptedFileRawW RegCloseKey RegOpenKeyExW GetSecurityInfo OpenProcessToken GetAclInformation GetSecurityDescriptorLength GetSecurityDescriptorControl GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner AdjustTokenPrivileges

version

VerQueryValueW GetFileVersionInfoExW GetFileVersionInfoSizeExW

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

ntdll

RtlDeleteCriticalSection NtYieldExecution RtlNtStatusToDosError RtlSetControlSecurityDescriptor RtlDowncaseUnicodeChar RtlReAllocateHeap RtlRaiseStatus DbgPrintEx RtlInitializeCriticalSection RtlDeleteResource RtlReleaseResource RtlAcquireResourceShared RtlFindAceByType RtlInitializeResource RtlInitUnicodeString RtlAdjustPrivilege RtlImpersonateSelf NtSetEaFile NtCreateFile NtQueryEaFile NtSetInformationFile NtQueryInformationProcess NtQueryInformationFile RtlFreeHeap NtClose NtQueryDirectoryFile RtlAllocateHeap NtOpenFile RtlDosPathNameToNtPathName_U NtSetSecurityObject RtlAcquireResourceExclusive

xmllite

CreateXmlReader CreateXmlWriter

user32

CharUpperW

Name

.text

Size

554KB

Virtual Size

553KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HFkiller_full/ps/Modules/Provisioning/provtrace.wprp

SHA256 220367734fa373b7ac044f5be8c46ec82aede78fcc1a63515240893707223dce
MD5 0106d08c3988d53bb5d551a55203a2ce
SHA1 c8f374f42e8e0c3ee5243b23dfb84d2d94007df2
SHA512 909c83e2c5be8dec07e92c9b3798150d98ab87aafd2662ca481bd1983c2c1ae3badeca07a92b1a1d44d70a46ae5c012c97c02c182298a3b01697b87234c1d2a8
SSDEEP 192:UAMyknKwl2wIwywPw+wvwAw25wfwJwxw4wzwmwPwMwOvwywBPwkwdwowLw4wdwFC:ZMyUYQMJI6rRe
TLSH
T14B023470E7AF99128E3A6D213ECF0D59ED1C02EB21195A10F1BE6972EFF7A054D224D1
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Provisioning/wiminterop.dll

SHA256 7d7e003d8a90aaa29110eb22ba75716b71be28ec3cd90beeb9fe1ddddae0e406
MD5 55f98a51a50da9b3a42749150bfaf348
SHA1 674b50c9705db42fd7420f388527bffe8fadc677
SHA512 b46b342d160203557fb22f1338fc5aded9215a498027c0f8ae73c916e620a5f7c5d77a1e1e4ce3aa1f765acbb9aba93dac9641447a61d7310afb2e9fe3fae373
SSDEEP 192:GZ4XF+h2Hs2/uUBDzmFcjkJ1naMsEhgN0u4WvbDW:v+h2M2f3OnaM3hu4WvbDW
TLSH
T1B552A6809BFC422FF9BE377879F22A004331FC95E572DB8F0594202E5D66BA419567A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

WimInterop.pdb

HFkiller_full/ps/Modules/ScheduledTasks/MSFT_ScheduledTask.format.ps1xml

SHA256 d9ebfa9a210f3b00f65161593c956764a89841a3ccee18ba3c155a7dd1c81cb2
MD5 a52f7bedfcfe35cea030bbdeaca62405
SHA1 30594c21d2967425517a5247417c93e5834cccc9
SHA512 7cd1e6cd3706c8e81d01279d9382e1013256bd524217e11363bbf8cffffafe509904fcb5301d70b153e3ac460e7f174ccf00c2bf7da222b04bb5b690a5fff70f
TLSH
T19641930B53C436D20937C45ADAAC156ADE25B15B185F7AB1B6DC830B2FB1D068233A37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/ScheduledTasks/MSFT_ScheduledTask.types.ps1xml

SHA256 9c78ec8fbcfa79f569e94f1c9c3c26f07dc848ffe338c17fad42129854d42883
MD5 3aa902c75f46bc189d7dee478a3b30b8
SHA1 10ad93919b3aece8b15a62df7f5c761aedfc4eac
SHA512 b0e30ae99639acfe42c1c3ad404a0413dd8965271401bf6ecde7df606c8a176d8eea55e7fa76013c34e8de9f31d12acb00ddf2c061d334ff36c17bd50c6cf575
SSDEEP 192:0sEgDG3ksEgDG3YsEgDG3nDjqGLjqPumqL5a:hQxQFQnaGCYg
TLSH
T1E3026C72F6FC84A08AB8501BFF75FC96DE05515F803B92A9714C4B877B28889D7C3926
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ScheduledTasks/MSFT_ScheduledTask_v1.0.cdxml

SHA256 692e53a278ccae9fcbc9449f68dabdf62cc69f2fec3295e2b37e1fef472efc69
MD5 780823ae38e74abb18010e0b09f32b32
SHA1 62d51f5a7dabb76edfe5d5d0e87a07b6cd095c9b
SHA512 5ed62e24cd9278307db5f7220c10c3e2388439ee65c8cba4dc9ed414b572e47b9178f44e2ae219391b0fff3986e8510b70dd97d9aa0f56c5f940cae1f7bfaf35
TLSH
T1346168680AC5ACBA4BF04A24D976B458ED38C5F3122C4408F19F37275FB78515A2B3B3
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/ScheduledTasks/PS_ClusteredScheduledTask_v1.0.cdxml

SHA256 71bf9ab1b5fd88586638e640fe90237a511ebc8e5ca4552950201b686ff17c5b
MD5 f00690c8f3c77bae9f0ecbf8ca17e902
SHA1 4591d9fd6fd4bfb6f7a0d0cbf0455e09736372f6
SHA512 0cb0ace5388c8c61f064ff30d20d8e6e2c10c957e4191aa1d4c466cd858088cccc1f3681f6426ab5bc3f1a1e71549c2a39907d7692d814521e6e14866b26ec6c
SSDEEP 384:KZGDPDG8D4WD9DEDGTDkDYaDCD7DJDEDIDGTD7DYNDED9DGTDkDY4DoDXDYqDJDI:uH
TLSH
T1B9821D2673C557E449B56168A165E8A09C7D12C3306C8548B0CF3E07AF3BEF5F6A3B1A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ScheduledTasks/PS_ScheduledTask.types.ps1xml

SHA256 3497ae4ac5e29c7db92e8bd6fbc0ac1e507be3f78da0e6f464b5b4347f00e76d
MD5 05a50f60e0b4b4ae19fbce96ca99c29c
SHA1 577e836499c1d920fd66b1c5862278130b5634c8
SHA512 8edae101a0499db643539b71305741cb573837b5113bfcf2511f2756cfe82f16c0096772e07820ca494ea41f464d039bcce6628b585e94d57eb3a25db1f88d00
TLSH
T1DB517E71E6B888A087A9501BFB76FCE6DD41512F803FE2A9310C9BC77B18445D7C7926
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/ScheduledTasks/PS_ScheduledTask_v1.0.cdxml

SHA256 fc7f13065f81d1141240d6e2f195ffb7ebffee4ebcdab06f057d8b25f78d86d2
MD5 79885d5628fe5d690932e23997d93652
SHA1 e11940a3fb3b1e9901a9db6073cfa6600187cf2f
SHA512 d76096c583cbcbc5fd0d2dee46c90828e5132daf8d248d9a80614b4aa0649a756d3122fc07afee6a68771ed8e2665a2033d55af9a8aba9786b4341ab895aa96f
SSDEEP 384:KZ6DbDzbDzIDbDzsDz+DbDefDeqaDbDnM2DnUDuDtD0DLDzIlDTDmDwDYIxDhDQU:utui
TLSH
T115530C26B3C557E446B155696165E8B09CBE13C330AC444470CF3E07AF3BEA6F6A3B1A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/ScheduledTasks/ScheduledTasks.psd1

SHA256 896029ef33b2dd2c09ac4978c05d11f6b4c657ac75f3a614ac80bf4c55e1a27d
MD5 e9c0f5e3e5bd2b002d94ac3a26cdc832
SHA1 a3bfffc535348252252047f00227090538d468e2
SHA512 e6600174e4e291730043e60bdcc850503c34358cfa3d5aa7ecca0ee16993c1ed2dbcccc3de2d00673ae36e1dcc7f00ec4a53bc763e32a3874b613b50faafe5ca
TLSH
T1FD41C13F940A3845AC7592BBE9006C89FF648A277026DD1DB52D055C1FF382AD3C0568
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SecureBoot/SecureBoot.psd1

SHA256 814db14fbb5c53f71b9f793ff6304091b3c409ec96468eb1a9dd097086d5ad3e
MD5 9cd8fefa1b6b57f8c334f15d40b1d04a
SHA1 b43a0703a25219a24627305c5e9d12542aa94945
SHA512 ffb322001a8cd2c137d6966c518b43ecde49d40adb9374d8ceface7f7001aa7c305c950047801f7d3ebbf54d41f4f4125527afb1481df8ef4be4ec0c91b47745
TLSH
T10CF0C0BA90E84923AD8DA2C3C161C14977FA2BBF98188B27D65D75044203CFDE3050D4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/DisableUnusedSmb1.ps1

SHA256 ec48ea87a7d2ee81fdc9fc61781ea77da2258002ea3206e2e6e3b3975f927956
MD5 cb5d71cd5ac260bd968edd33c40b46f3
SHA1 6312ce8c79bfeb25ac3246c9824446ebc83d1a4c
SHA512 d5f06e85e87a278ccea2ef1ea3f0f5e1c707a980b893020fb8ec15181c0ae29395ff4d2ec1e51d51a23f8674dba39279fea5354c43094ff7bfb662edf8b7def0
TLSH
T19D519D1EED538DE09953D531144BC0D1DF2D70B396AA4804FEEC83A43BC9CAEEAAD640
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/Smb.format.ps1xml

SHA256 b9815b64ea8e05f33a174fc2a78233e52352564c44fc9609f39b11fb8daf2259
MD5 805f3b050e132698e429a7b746782b43
SHA1 97f13514081147e332d08cf59001851319aaedca
SHA512 c2903ed7e929ad84b910e96ae980209f2535f502f8e49f233da34e2df15259411da7f196fbe4c9694a7def3d095bb527b805256a3e5a835d019940d8911dff8f
SSDEEP 96:JpqwwrXs4NqWGXs4WhwWXCXsXRfXseq+XsPpMXsxvvyXseXYXspDB10XsNr3XsQR:SsYz0+fM3elsEPuv6BJukWz1qn8g3gbC
TLSH
T1E743AE4FA3D03ED569B5851ABAE8A265DE10624B4C3E2560F3AC470B3FF1DA5413393B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/Smb.types.ps1xml

SHA256 7606184e8f23451d297af6d018cb5571c614fc8ef88861364a5f68dcae96dae3
MD5 989fc4d35b4b5099d3c2d03ae9fe9637
SHA1 5263ec61f7f56990b72becd2d93be3300d2022e2
SHA512 739c39a9eb250a43b8977a41f1b8e1adbcbc08fb817b28142d45c240f9e8637cfdd62cfdd44c67ec5a91b217ae3cebc47a22b4f0720b273e8aa7c617fa2e601a
SSDEEP 192:t2CTxiQgZBhZ/lZf4xiQgZBhZ/7v0vgZtlZtc:onhbJhFcIBo
TLSH
T1A5927C31F7FD84A094B851179F67FC5ADD02116B803B92A9728C4A837F38485DB97D2B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbBandwidthLimit.cdxml

SHA256 89a7e18790628f19f6cf5d238eb27fb3fd1536aeae63048cb5166d5bbba9de7c
MD5 4bdbbd333b04722f7cd51e3356017981
SHA1 88122adc74aca8f56495918b7afb6e6e426691e4
SHA512 b88f9a98caab8da071fd2717b2d90aec8e05b5337c3559d7364e306fa9b669d5fd609befdff2c869dbfa0e8f1296298096ed96a8c1795469b240131b0d4863f6
TLSH
T1E451CC1817C61CD18AB1421957A2B86DDF24A6A3A37D0805B1CF6F071F7BC027C5772B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/SmbClientConfiguration.cdxml

SHA256 950d83be6bb00d232c779592776883d20f9170e7ca4b8a8310c2b8b465f1fcbe
MD5 36b26b54142578d00da4433d0fcd2d5e
SHA1 89c1bb79f33078b89fa83a79e7ba7af2cdf30032
SHA512 4cbbe6a46fd4da7d927684a0befd4c50e4956ce4d303aa236f7e643a82ab8cf81450f1291f0b7d0f4bc22618210fc4ca8267da5af6437095ed7f2242bc1f1453
SSDEEP 192:xODIDfDhDXDXD3DjDSDPDTDdDbDzD6D+D/DaDuD2DtDRDaDNDhDaZ:xODIDfDhDXDXD3DjDSDPDTDdDbDzD6D5
TLSH
T11B429896A3C52BC546B146682656E8A8CDAE17C330AD104474CF3E078F3FEA5F563B29
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbClientNetworkInterface.cdxml

SHA256 ae755d15c10f66e4f8ae54dbfb8edbc54c361db924a16f6a735ba3ef7f1aff1f
MD5 61afd2df984ecb25b2dd4ecd05175e5f
SHA1 0c8a3e4c9036a0a9daafe028eb29796c5dc170a9
SHA512 1b5b6a2c67b36e0b3e37caf3185052b177448d250d6b6a9b1ebaf864b831c80c7217cd944d06c90ee35a6998cbc2c6bddadd0e14a724f95d9961894407991e06
TLSH
T15D017B50138661E1453091099792DC55EF052247C17BC98B708D9F0B1FBB8CB740B35C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/SmbConnection.cdxml

SHA256 73726993aa6f52331954c9377f12d351834b14be702fa708270baf45bbca41a4
MD5 1d8a3f846a3bdcf6ae9d15ec4fe1762f
SHA1 62201acf4a63f95d58a43da75479a69d38bd7293
SHA512 6e19bccbf3faa879c33a91196d49589a84395355af16557baa3bec8ebf35fa092f6867ac60f29f8f7022e3a867808c4d992210adc632a603d283302c5456ea8b
TLSH
T129418B0017C45CD64AB1410496F6F8A5FF24AAA3827D4412F2EF7B172F73882795B36B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/SmbGlobalMapping.cdxml

SHA256 86aa42909ea79f46e7d6a3908f41bd1ed57479169fcd5b14120f0eeec683726d
MD5 0e04bea9623b35440097ae86e600bf74
SHA1 fbb0645fcdf0496a734c4c497ff1e7176d5b7ac6
SHA512 7161c6cf8749ac8f3dadff0b99fd51f67163a614dac137509fe829bdd65c3c53f0d31374b2d6cab63f1d04f41072ed4a79fcec4d7563e418b6be8577e8404e64
SSDEEP 96:mYE9sXsm/wwXQrxjGykjbiujHVjmjhTjujnkDfAWDJDn4:9g1jQjmuj1jmjhTjujkDbDJDn4
TLSH
T17AF1304163C55AC446B04128A6A2F8B5DEAD56D3B07C4404B1CF3F078F3BDE9B963B2A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbMapping.cdxml

SHA256 1d07d60be061c6cab64fcba3dff66c6b7ccbaefb6faee582a1410417e303b86e
MD5 6ddd5ba90a73e7869eee9f5881b22ee7
SHA1 0105104448654cc0c13952104f77a5455e4b9c29
SHA512 14d517f018285882c629c0a29c35a40d3e6b5242626cb6c9e4be0ac08418656bcf21b71c992682ff927df333bb54820346c2aec0fdbb43039f8c9902961e1209
SSDEEP 96:mY89sjs1r2aUzewXQrxjbfqQgX79v0vZEw44VGaYRwaav:3g1jne7lEPjaQ
TLSH
T111F1780523C52ED546B04019A6A2E8B9DE2896D3B27D0045B1CF3F072F3FDA2B973726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbMultichannelConnection.cdxml

SHA256 cee9b9bbff90ba0995ee61fa483c20819291a65f7a152641ccfebfd875c836d3
MD5 6b83ac009d2c1439641a1fe7212273fd
SHA1 7e54325787c5749736b37d9c0b0a5d6fa8459bcf
SHA512 d02cfaf1130b2b29f2ae9f057df989bd80787effbbb1f0c05f29f9eda8239a1c0e57b84ea0f0bc38166c985a0018fd7c7369c1205c8ccc583ed352b5fb84028a
TLSH
T1A161AA1027C55DE18AB2501996F2B891EF2867D3A2794841B0DF7F071F33C82B96336A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/SmbMultichannelConstraint.cdxml

SHA256 ed6fa51c18a38c7d7b5d6099cdbad4556c4f8477eb7a48bbe8a449c54cc7c084
MD5 ee2f9b8b0b61158a781ce4981edf6e64
SHA1 786192e39d32710ee7de5b34003012f2d88b7bbc
SHA512 e92279d2080a5c4a95e59d96191a0ac97f9028007bb27110d45c85b775840a86617d1a2f638c3e9f1b0900fb2a0c0aa1de1adf2eb3350821378c9acdc081489c
SSDEEP 96:pYV9sU1rf/UH3AbDkMIg7Ajyiuj8WMTCAjyiuj8WMT5:N2DMjvujoRjvujo5
TLSH
T1ABE1BB01A3C52AC586B15119A1A1E8B1DE7C52D3B1BE0445B1CF3F075F3BCE2B9A372A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbOpenFile.cdxml

SHA256 1c73bba7c7f1a0b311b2e0a9ffdbe70655f94b9421f8c51e1cf3dbc58e5bc3be
MD5 f03b935b9ceb58044a96def6078a4ccb
SHA1 899e813c9b572ee355e1351165f931bbe66eeafc
SHA512 12c607b7b62ac90e2244f10151181c37c2881ab7a5489ffdcb0a227cc2669e3dc7c9d665df06b5aa85b34a36c4315615395a7c337b0cc25e0f71566a1cd24961
SSDEEP 48:32Y89sxetag7sdVwSL7lPuJmrk1mHSfnoe1TjhtvokRXbym:mY89sxebMq6V9rjyfnoe1TjhxVbh
TLSH
T1EDF1000053C92DD54AB15105A6B1F4B5EE289AA3927C4856F2DF3B0B2F37C5278A3727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbScriptModule.psm1

SHA256 dc380ce7921caed2d51f9baaa6bc2ad88759e9b5edb34605c5664143f43105c3
MD5 0312120179930e16c4e212817ee4abb3
SHA1 1f36b45943c1eb5f7a4020cb3cce193a5daa153a
SHA512 853e8fd817ce3dec784c0bbcde950544bed65a33ab1049ec707e7ca77b45678488ce52203ebd4febe9f0d7b361e87b9b071f356a5e19926dd94a404e6ed6eaef
SSDEEP 96:ex+GSox0OwBxCrrYxup8LlYUa18LVa8J68Lk5SqdYIHRb:Q+y0OwvCeu+lYYVaSJqlxb
TLSH
T142A1F0E5354212519473072FFF278919EF291023517D0A68F8DD96893F35842EFBAC5E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbServerConfiguration.cdxml

SHA256 00d5fb2e678dd5031e69902f23c898893f1d8fe473c971ad532ea6fa50fd2f7d
MD5 978816ac4992f15d71d55075d028b688
SHA1 395564b21e48345328d37716a3e87e8d32e7be16
SHA512 6c8f4b758098ad5ef2f4c9e24cd9d0c02464ec70ec401e46b28c01a34f10b68d8ef5b8a1f9922c91640d3f2fa6ccad66ffbe898cc6f223f0493103197727619a
SSDEEP 384:ajbDTDkDVD1DlD4DxDfDcDVDcDTDMDdDKD7D5LD9D7DKDxDRDID8DkD0DIDuDRD3:MS
TLSH
T1D3825786A3C56BC946B146A82656E8B4CDAD16C330AD104474CF3E078F3FEA5F563B29
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbServerNetworkInterface.cdxml

SHA256 11f06a41538b9750c31c3f984aab7432867bf21ed2cb58b0b41eb07acccf76a5
MD5 8a3f078dab312c3f64ce36528242db60
SHA1 59e9cc18a9394a0f56c1d69830aa8a393dc61805
SHA512 aa4eaae731e2a97ba871b8414b39746cd244dc45375c9e2185d45a07a919e79b51fda20c4f559d411db9cba5fcc485563af84cbbb803b60519333aa0d8a9abfb
TLSH
T147014910038651D18934D11A4796AC95FF157687C53A898B71DD9F071FFACCAB40B369
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/SmbSession.cdxml

SHA256 be71895d5331e5af1995580367882fa15d06170e8221fdd298620fabca9d960b
MD5 c3bdb222467a47e708f6cd5eb8e85542
SHA1 2e35c169f6d9c1637d04dc3ac7fa766d78d0b855
SHA512 a2d27a3ae1ee886b39883a25d530cbb0af88f0a782b2c00e945970b5dcc9e7f0cb1cef512a4423fc79796817e9b1f99000ba9f7956c0b5fc2b2e11f0b9b0377d
SSDEEP 48:32Y89sBQakxTmPumrrmHSfnAer7t7t777fPuNURXby9:mY89sBQfxTWRrKyfnAg5RPTBbG
TLSH
T17FE1320053C81DE54AB15104A6B1F4B5EE28AAA3927C0856F2DF2B0B2F37C4278A3737
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbShare.Format.Helper.psm1

SHA256 77c7dc0138ab3f9efbfc8baedde330ce11ee113622741a22f9a1da6fc2883128
MD5 40435cdb5a8ea66c5446a5f377c92fa9
SHA1 c92ac93cf490f5d779445572208491a827139031
SHA512 e8a667dc8f743df7c47fd8207941f9d72b5e42a2e0a8cc4e85782b36cbea5453f2bf30f13866a75d307a29cca148c71dec18d5f6f6119d95d50bce58e4340f63
TLSH
T11701FD9D74028017F0B2A81648037108FE26B31B98C806F2F71C5AEE6F30CC4C224E5F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbShare/SmbShare.cdxml

SHA256 37bd6c0932b185f6974049a9d1e4624892c6d20bd5106e23b229e30b05f9e2b0
MD5 c10bf8742a36d1ed3b32b7a3a3ca714c
SHA1 915709753ceeb676b9f1d088106b893cab324917
SHA512 c71280cfbb761893a94db95ff0b09720841defa1d7ae9dd8636cc016e8010f733da7d29e80ae1c3e8b05c8ae167ac593b28cba9a3d064b875d9cd89d0dd4326d
SSDEEP 384:2x3TlRD9jDj4H0HR3jjDi3TDDg3TADg3TbD+Dg3TEDg3TjHTKLEjHjjD6DnDLDA6:1
TLSH
T11AE2320463C51ED546B00128AAB2F8B4EE6856E3727C0445B1CF3F076F3BDA1B9A7726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/SmbShare.psd1

SHA256 506d27e3f839681ad333c1acb29282acabe5856e77ce3f54c1b54e68e0eacd5e
MD5 f6dd5722ad4339e6e9d3b49bf5eb9fa9
SHA1 dd6ad3db07735ee3e40821fe03ca7a320313b67d
SHA512 d9178640405396e51a7a67ca68769b02ae235dfbe9223f852b5954984546b0507719c0e15c399532b5dfdcc9df77129a472c1cdf46df1cc1390b1edb5173ad8a
SSDEEP 48:sDY+DpD4ZvvOWZ+RUfcqRzOWHqSeFphsCPTWqcTcGQG5:sDbDpD4tvOWZ+GR60qSUphsCLWqcTcpq
TLSH
T18B917BA4713B16E2E033F3479355AC08D1A52BB3B022472BB67D414C0FF8A939EA50B0
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/SmbShare/en-US/SmbLocalization.psd1

SHA256 1aa780b44c577747011d2c158add3c32b4f8234ad2e241ed799a2dff0f5b6b49
MD5 fdd158ad5db5fc83f86f29b5bc5445ce
SHA1 3fd4ec61202f8de8baa1b5ef9aee796c86a1075c
SHA512 1c218c97389b302528647ead3901e0bb84415a7c2afd1e6d773c057b60412f769b288d1dfecb6048a798a4a1a50115e6b99bf19abcd8587c4173140f4171db4d
TLSH
T1D3F09E711AB63A9560E343BA841EB191C33640DF519217653587D2402B724504347E69
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbWitness/SmbWitness.Format.ps1xml

SHA256 f332bd31019502c966f806d6c338f73b2d4f24bef76957af5ef220af80dca791
MD5 dbfeff6497092ae9353dc3272c6093d6
SHA1 966349670d1b7a8688e77fb58515714fc4e43cb8
SHA512 bf6286c241016a920cad6b6f32fdacbe422f09311bf309a879282d7e63e87730ebd620221c8bbec91a39a1f48b62a4ab311744c66de6ab7318304acc4d4e10c0
TLSH
T11A41840F63C03AD28A37D5169AEC6625DD10A0571C2E7A60F3DC470B2FB1D164177937
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbWitness/SmbWitness.psd1

SHA256 924b04fc5d449195284011d265316b2d25d57a01189a84c8d983fdf8d0b6491d
MD5 0820565f1a63e132d450a6e8901b9b3e
SHA1 641af57282ec967a0771db073e856d2aa2912ea8
SHA512 b51b4738185189e2bb120db44334182430c0a27dee41c00e12b9e4e8554f1021b37ba2ebfa6a045f19a9d0f89478bca629bb7b52c527aa99e7959be030c67dae
TLSH
T1230170A8B41D7156D9379543F0698D04F3B45BD7152AC612F6BC6A480FB3F035349598
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbWitness/SmbWitness.types.ps1xml

SHA256 96ba4bd8eb1d894ff061b29993a5099a049d7568546b452df8b9ba912b0d7778
MD5 f4c213ece765cddea3afac09aa24a215
SHA1 baec6436d1f294bbe6b6e6d3fd91697d4b5beb7f
SHA512 342b8becd378e58e4924c4daa85134b677989f672f81be012d30bf548fca839154fc292e211ed516f589a2be14be66c7be87b9836765834612ba4ddb0f59f979
TLSH
T123313B20F6F8D8A0CAB1610B9E39F865DE0111BB443BD199728C4E873B25885A757D36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/SmbWitness/SmbWitnessWmiClient.cdxml

SHA256 06d705ae5f818ba19ce3ce31058e00301b95a7ed133c7d62b034f5f40f494872
MD5 db14a59d74715326b742596881f5e2bf
SHA1 808a0505bb3c5e41d0e6502584397d7b4c29a97a
SHA512 b6dee8cb5cd028b0c8bff0ed107159e162303193061bb8e5ed31ee8974586bc3e03aee359f8ad1c8a7b099bbebaef3b7e78e5bde1bbee93a05b8cea118d8a8a4
TLSH
T1CF61660827C42DE28BB15509A9B6E475EE2892E3523D4045F2DE3F1B1F37C82796B736
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/StartLayout/GetStartApps.psm1

SHA256 0521ed7ba83cf263eac67bca8781598a96f5d4009586e745ab4562f1af558780
MD5 e4a1a14bff7c1545ab9a505a53cbf3b8
SHA1 b7c0db4e26c7a74164789723ffdc5c45d194a1df
SHA512 d700b1f9125dd0c8dcd0a6c4fb82017da2246b95d356e1eebbcc6cecfb9db2c48e1190cb3fc2abcfa7e3dc2ccf8222a25d4bbf40ec84423afe0fb318c848030d
TLSH
T1B7F068889086E1C1D17AABF6E64EDC4CEA26203F08490A04B1FDC1C11F3096A45C8D4A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/StartLayout/StartLayout.psd1

SHA256 137c977a6a131459f6b3d33f3ddd6cdb126a059aadab4f55bd96fe40ebace982
MD5 467b23bf98d27c9e13690bc6e1efe5fc
SHA1 8d0a96ca6502697f62b22cc3e879e5a9ffd4c9f7
SHA512 d7434515f3e27230f8f5cf18bb63c5526790d4db18bd886eff49b03cf15668a863f852a3c7399110be4d8050002467a818d0d6b72a01aca2eb71bf9d3c380862
TLSH
T123F020AE7008D667FF47B753CB21C4A4B1F81BAF080B8F48D0AE0380025B9B2D3C80A0
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Storage/Disk.cdxml

SHA256 22c23c6bf0bce59c6ed6338681260f2c336ffdb5dd09ba4a27c916167a1b5adc
MD5 9773c3417c4bb7d298cec0ba694cc123
SHA1 40be585779059dcd94e8d539fbeab2ca760563a2
SHA512 0f3986348ff8433233435dff39120ce9a3f743711f8301e178004a38849b65e67eeee463549541166c8051c14f665324fe36806aa218a160dba54116496908a3
SSDEEP 192:J9sQxrX/x4OjsBv+2D2oEJwVpdvcvDoRD79f:tFyOjsBv+2D2oE+VPE+79f
TLSH
T1AAC2941463C51EF942B11119B6B1B466EE3846E3723C0458B2CF2B1BAF37DA17A93727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/DiskImage.cdxml

SHA256 ae21a287d12d28d7b51cb16eacc7e8aeb6ab29e88a800044882ca6225595c6c5
MD5 f2d67eac535ea30ffa41324d24bc0e43
SHA1 e185d244eb2bfd74540d174e8296ba65c97bcfe6
SHA512 6f845e1d47c270866fceeb11df5310a25359c2f4ef61fe325555f1a72ad057535bdff5d2b72aa15113541b176e34476f94e225bae6b03e4c431eedcde7a5343e
SSDEEP 96:rYE9szaRM7KYB9cJrD6PNQhE950KE8NAwcR6fN/OKsE9AwcBrb6fNk0aT4/Y:xRqyJ0ANIANxMC
TLSH
T1CBD1581467C10EE840F61118BAA57861EE3946E3712C0A56B0CF7B177F3BE61BAD3356
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/FileIntegrity.cdxml

SHA256 86fa94f294f6bda4f68c0d9ad2d37b67eaf81592b1c89e25a95f8b3290948e8b
MD5 25e9b68e20274783f3149cd6505154d9
SHA1 ce805ae2f2613f68375e9bdbde710194f2d37dcc
SHA512 75f71e786f70e6f25cdad15ec17c7a5e8c57b22b9e9279932ae0698d4889d499e3d8ef74a9d7ede0a50596d5aa6ede8b45d2f18280bc4640c2553aea17d1ed1b
TLSH
T16761642227C65FE04172911936B058B2CE7992E7712D4991B0CE3F0B6F3BDA1F8A3756
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Storage/FileServer.cdxml

SHA256 dd5c550dc9fdf10f96a7a92a615625d0eb587db32535e6a62d14a0ace131420f
MD5 001819d786211abb839bd6b383312382
SHA1 ceb5777859d6a6249647ba1cbdb0f14a1cc115a4
SHA512 7cc27256b9593cf2d898757f0f9cb13c75f013c813e36451b40cbe979d77f4d0aad3a2f79893c74e1c42276a23a3dcc0eac89297e7048af6eb60ba03bca61e82
SSDEEP 96:rYE9szVHrCf5KapMUN2Tz6cYVHuWN2Tz67LWUfYPaiKGVyM5Fjb/IwjW/z6jkhn:VfpQ2LrcJjtvqn
TLSH
T14502641023C21AE542B10219F575B872EE394AD3727C4955F2CE3B0B6F3BCA5B993726
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/FileShare.cdxml

SHA256 646d6857e4697606c91cd275c5b9e0fe3df07c28af5cda68f624a61a5afa8a8c
MD5 d8ff294b146b986cea444ee1714597be
SHA1 92fba1960d8e9bcab9168e07f9c5d0181b555a4c
SHA512 06d23b24aa7630148cccf09c19ba06d8100a2680e4ca95b6c1af294e0a08b7b0a0b67bc9d535486a1cac222e73cd37a7819111695c2bb4fe40363c2d4b2853a0
SSDEEP 192:8uRC1WgKLglMgKT2gK62gKzW2gKugK2qMR:zRplgmp2U2lW2w/S
TLSH
T13C82AA1573C21AE641B55209E631B866EE2946D3723C0649F2CF2B0F2F3BC767A93316
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/FileStorageTier.cdxml

SHA256 d5b609ce8c40dc4f7481f54be713d212d9281fc0403bb504a69b81b7deedc325
MD5 c23cc7cadf47195b08f57c7eaccad63b
SHA1 8b6da0ecfcf642b1557f27d601da9e625f4b6e19
SHA512 efc63f50bb090f03366edfede05e4e2b6964c2787af0ac0dd2fda44806b1c139a85ce522bee3831f072e97fdb2cac8a40d6a8925665683231f1af664ddd1deec
SSDEEP 96:rYE9szndQh1U+cU8Nz49lLVU+cU8NznaahDWU+cU8NzNShU+cU8Nk/S5rNNSIWtw:2QezZz5DbzjPwMeTe
TLSH
T10F42121123D65BE861760229B560B8B1DE3942D3725D4891B0DF3A0B6F3FD60FAA335E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/InitiatorId.cdxml

SHA256 a7b58fc9d28ebe0a9c76fec791f317d464f52089018f31b9bb387db0808b62f5
MD5 b87332fe66ac66add4fb9fe725f9c892
SHA1 373360b9a850f1fbf0628254126b8a7de92c976f
SHA512 ca180bab771e865e548c5d8e81ce3c746481bf0ef301d417924af51ab36d1b4b6bd324913a97861fcfbd0d0175ca1fc22ae2ea91828a768fd8203d47fed4cf05
SSDEEP 192:JGjlrDqpuDDz0IXZBMUJuehyTa59TZj00:JGjlrDqpuDDzpZBMUJfhyTa59TZj5
TLSH
T15BD1DA0923C19DFA82B0681962B2F455EE7886E3637C0604F1CF2B272F37D656767227
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/InitiatorPort.cdxml

SHA256 abdd4f64504e4756db8ff2775ed1128ace27d7df27c3a81687dcce48a544560d
MD5 322ca32a64c4d19e438d5399ace8793b
SHA1 a5351e51b170e7c043d261bf4b8d6e8942cd3778
SHA512 0c653857c3881bb566ce828304fe6bcc1936ecb87b9ecf50311d4374003981dfc17c9d2c6c42dcf1f99bf3ff5ceed94456abdd596dd7b705f60ef0e4fcdf028f
SSDEEP 96:rYE9szqKFvkugKohDy2KmILyMgKuvrEykgKNB2gKZ8OfgK4rKljpZN23D4NvXSoT:SRICsuUb83D8vCAVX
TLSH
T1B5F1200623C25EF682F56600A676B456EE3845E3623C0544F2CF2B272F37D617AA7367
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/MaskingSet.cdxml

SHA256 38d01b6992c1687f3c83a966476d45b065e3a0fbbfec58f0cc0dfbcd41195d28
MD5 ed7d5e65a221bc03b6c9eada03f49715
SHA1 022a7500dc1c4bbecaf071ec657cc06cc9150dbf
SHA512 e0dcb16d2a408aa9efa5d3f12ba1a85f7ffb77c90454b50ab5cf0412fe8dfebed2a69104d99f00e49d3dc74d624aa55ac72d5c43e143408279a34b7cf33e16d6
SSDEEP 384:+DzDTipN/ZqfQTSTOD8QTnTvYuBgDTAj8DTaT4CxuBeD8DTaTZD8DTaTjD8DTaTo:1pN/ZqEYuB+CxuB1Iq
TLSH
T19DA2950463C10EE942B02528A175F4A5EE7946D372BC0915B2CE3F076F3BEA87563727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/OffloadDataTransferSetting.cdxml

SHA256 197197af71078a53cea6ce3fd8d177204a3823bf784d5b840c8ca4aa67592905
MD5 69be48d280fb33d79058380c3c8cc844
SHA1 9be2893088396f70ffa1efb67bdbedc4d8846b0c
SHA512 78e8d6cbbf8fd972d7583e3f656344de64347cd118c6a9f56ba78560e4d7c54aa638fd5f5c3aca0ce0f082eb6d0849b317bd5ac81e38d5ed7e17e3911284eaf9
TLSH
T1C3219E1023D1C3D9C076A106A799F90CE639AA47A00CD14E70CF1717AF7AD5A739375B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Storage/Partition.cdxml

SHA256 bc6c894fc306390b4497fe1e08dbb4b7d96c2a33e98ab4f7a7a584dab4d622e1
MD5 eb7bde3d03ef619de624b9834f9bb0d1
SHA1 3c1fd88b4e9bb8ff06483cbccd3d23f3847d3fca
SHA512 81f4f7fc92b5f32d33961fdedc968470527f9adaa1782c9d2fd68343e46d28be1cb9099f5ab77dbc0820822f94c137d61e4cf7ecec469ce2317271f23bd8ef10
SSDEEP 192:qlBPz6D4bHf/7SHU/7aHkl7El+DcHU/7o+D8HU/7N:qX7wYHfTSHUTaHkd/DcHUTpD8HUTN
TLSH
T17E82851063C21EE845B55015B6B2B4B5DE384AE3B27C8819B2CF2B0B6F37D927593727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/PhysicalDisk.cdxml

SHA256 1cf415d4db533109258245221c1c2f2079fa79f1aca31fcd63ec81c798e1e858
MD5 1076708fb3b3b374362254287f81907d
SHA1 6b74cb6025dfd0413786dcb1e0e5af1414c070d4
SHA512 fad96f42a48209115fd13e3a684ec62a6df854d38ca5daa1872877d9367bb6c905f491f3a79201594bf78e9a58fcf8cb6acc49df114b65eb6af47d82d674c23c
TLSH
T101D02B10D8C589DD80BBE20C20DAE891F241634FC04CFE84B2A4BF06294208AA0477AD
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Storage/ResiliencySetting.cdxml

SHA256 666e4ca38ef937465ee865d2424859140d3ffb53a55daa91c7b76d2584bb1f22
MD5 fe7c23b57712f78058fc233fb8dfb525
SHA1 ef2b736759913d84ca8277fa0230f9fb712731e8
SHA512 54e079eec7f9f6d13c32ff022583c29c509101b4c879a6e59019f7f35e2be705c8c47375237435b2f407a1ca116047ceeb5ac6a737af560877429a83f7887378
SSDEEP 96:rYE9sz5X7nrK/1tv0eWZ3K8N2TpzTKPOWQ:caM8pWQ
TLSH
T1DFB1781023C55AF841B51229B1B5B976EE384AD3712C4458B1CF3B0B6F3BCA1B693367
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/Storage.format.ps1xml

SHA256 4f74832ed9f821676785ce75a30f6b4958bed92bf6e9e15159df49fcf841f0a9
MD5 3ced5d5e24a95fc3d50e856388c33aac
SHA1 f3cfd9c315f2fe49fdca43cee4bd6f9f0da316c1
SHA512 00d6f1c1fe7000bc73f384f231e4c0d551568edffcac25f8acebf60070156716f1f5fccf457b28dae64f1415c8d574281e088183a650e5e5fd86a1f17b7a41a0
SSDEEP 384:9jYqgvfcWQrfHj/JYpLHGW7YY8QgOY/JcJ9bwl6riQ1eARIyD9Y3c7lGJ:9jY13DQLDxGHGWt8QgOYW/YQ1eARFlGJ
TLSH
T146A3064F63C439D64A72C55AABEC6629DE10112B187F79A0B78C830B1FB1D568633D3B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/Storage.psd1

SHA256 d95f54cae8bd5aad3c802db78c4f7eb6e70cab08ca1a666b707225409aa36b2e
MD5 628fe7e7aed1af48670ff5955d5dff6e
SHA1 4c6081845e77111ef25dd83583070bc9ef708ebe
SHA512 de986377857b3f6aa1cb32e521ff2fe3fb98f4f0622194b3fb4319c27fef80c774635ceefb67f18ad8b2e26e27abd341357c428c0927e78892741df0fbd52eda
SSDEEP 96:i01DbDpDCfyxhbrTzVBX7bmQrx99fETo+uTmUUnbkJwRxjJINKPVnatfLjOC0+w8:PyfyTrtBX+S9NETo+dhxjJVaVqPPG4CF
TLSH
T179E1302786034AA89271EA3FB184BC85E1310B77711A5B13767E12A92FFE80753D01FE
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/Storage.types.ps1xml

SHA256 25bef102d2c02cf9e25aa5fa1ec6776edeec0eb393f8cc5d83d5699878c0e001
MD5 ead62738e225111e6198c08d6f4e6dbd
SHA1 8772f6d03a40f5a553b122788daa59f4b4e9ec9b
SHA512 4e1b5b83a3a652863fe662ec301282446eb5fe7ecddb62e9a1c2599998df685d349ae7671d882d3a4d5c1520f4f4ceb9f708ffccff9cfbb248b957a11e9311b1
SSDEEP 3072:z7uyM37uEFNc71/7IMwn0+Zcr++sa6YSz3A7c7EZAepU+SHdrzl49++87UP+9sbz:HdML4pGCG3o70w22lEAvZ8X8Gj+IwNn
TLSH
T145C3CE11AA9E846084FAB377DB2BE179DE31053B41B79088724C42CBEF355C9DA4BD36
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageCmdlets.cdxml

SHA256 8f9abbd9282e74065e79febdff67a3fd0f006ccc8b5059e71469978f5d0f6442
MD5 fb0506e07a732d1929f0400c81beaefb
SHA1 4a8763224f24a1afc745adb6016463adaecb260d
SHA512 a99c0a3d24ac67db77a1f3137a4ed98f154bd6c8df6c4819eb752d6f4350f23175d5a3ef33a6abd48867646e7ff98836b7c46b78b3d923413dca4640d0209b94
SSDEEP 384:uDL4KyJDG9rrwD6oW0iDg4T/iCyDUKVP024DzKXWOKXjsKX+tKXcDGFDiV9khDjT:5YQiIV/zGNmI
TLSH
T1C2E3232423C65FE841B512287571A8B6DD7E46E3315D4494B0CE3A0BAF3BEB0F9A3716
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageEnclosure.cdxml

SHA256 0c833dc98364faf0c5579eb2705f71e9177c48901772407f4749de67bbcd3dd7
MD5 925611988ae034337245daf83dadee7d
SHA1 de1509eb3731f1264aea36aa3a97749047127659
SHA512 8c0b8fbece9e552247fb9def5cde83a694f09b844be6adf00b1127498ecdaae0431209814a3a0db9807c492e53f1e04a99e4dca4ce38361dfc26ef6578717d44
SSDEEP 96:rYE9szfIYrKlh8KSzKB2KKpAoRc1LD4N4cziDWcJLD4N4czi3tvDp8N4czi/L6xi:IsoRkD8b8D8cDSJD8pD8o
TLSH
T1CB62421423C15EF942B14118B2B1B8B6EE390AE3723D4455B2CE2B0B6F3BDA57593727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageHealth.cdxml

SHA256 7be1f9e9da6c3090812eeb080dc3ffcade80aea2a20c0d5784c8d2077f9435ef
MD5 efda59d1e64fee7b5fcec0d0020fb53f
SHA1 16606f5a3a237f9fc6304ba1ad7c65c2bce6a0ff
SHA512 e5a16193035cf50b5aada5970502490bca5e74aebec9cc594a446a2f1895d7debb0835227c593e955a2959bd7881f20c4df0b33b397ec6a26ad1bb0e4e547ea3
SSDEEP 96:rYE9szKRXrKaR7DCZSimHbfivcIStfoNAStfi:R1nd8eCL6
TLSH
T1DCC1991023C24AF581B1111DB670B9B2EE3546E3717D4915B1CF2B072F3BC6AB69336A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageJob.cdxml

SHA256 2c6595611bb589bc292a3048467af64e09ea73c7e1eb65a51df0caa43b802e9e
MD5 d50cacac4406969b46018befbf82c8f9
SHA1 cfe525fb67a33f486ff81adc1c1e782cbfc16e53
SHA512 d3ea61c5dbcde63f9d3e0f176ebd0dd9cf34e781168e99449e94ddc12a33de0bc23edd125d52ff871278ea9957659cfbb0a8ac7e4493a2dc6d20ce521acd517a
SSDEEP 96:rYE9szZM7D1hwUdjk3Kyj3K/w93KuvrEat3Kj23KYBwX4TkYn0rJjw2WqRc1:TDIURiDc2nfoE
TLSH
T1FB02E00817D15CF682F10629AAB2B815EE3845E3722C4148F1DF27275F7BD6167A732B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageNode.cdxml

SHA256 e5adcadbdab3aae64ba5352cde721de8fcf9aa60cd9a0cc478047b5e94d35ee7
MD5 f8aec0d533d7ac02ae8e3c7ea6443669
SHA1 05407505b98b9733195174747c4bdb543410b7f3
SHA512 9886af289f953c2870508436fcb44d4faa1517309bf7326fda747e6c29a293fd41aebe58f3b5179751722bfa634f1fe5359d3f25c0f435706ad31716b10c6388
SSDEEP 96:rYE9sz3vphbDdKjgKSVKpAyK/qKKwqdwKuvrEpZKYBAFVO:kD4Z
TLSH
T1FDD1AB0523D10DFA81B652157265F955ED3502A3622C8288B1CF6B2B6F3BE65639331F
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StoragePool.cdxml

SHA256 a4c4d6780d83e8981af1989aac93b774ee33cc460745c48b7308aeaa01b7008a
MD5 73320985c186781621f39112b9cbba99
SHA1 f0b9905491d339c61648ec3db9e5efde529bf7a1
SHA512 c1353444c432a75e981a2d9536dda5c7898a72ad6e35167ea952aec5011621ea3e2c616dbd44e507f38942e0ee0c91089a4b6fcaecd9170dcacb5c83f89ac8f5
SSDEEP 384:HKdDxDvUDTDqD/6DJdDQD4DIDoDNDfDNLiV1sNBq8D/6DJ3DuDvUD2DUTYgS5Did:HKIzX8
TLSH
T170F2661823C11EF942B01228B5B5B865DE3946E3726C4444B1CF3B176F3BDA5B6A372B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageProvider.cdxml

SHA256 c1565dee35dd91e96f376b73ae82a07c077c957e3a3a094a26d7de918b474822
MD5 e74fcceb01a08b8d752823b242d54984
SHA1 54d1616d345128a6ae4b630b9c6ec129fe03552d
SHA512 ce6ab8066e7b03a8cba55a88ffe46743370e662e879bfd4d3c01376f733acb89e2a72e1b0f65d576f3488381439f69de10e082d80e0e1e14e3e185e2f4536c6a
SSDEEP 192:d0D7EWeZzLwrbDpBU5avBZjK0M5avBZGmPV5avBZDSc:ersvkU
TLSH
T1BE12522023C25EE542B11119B975B871EE3946E3723C4456B2CF2B176F3BC6179A3367
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageReliabilityCounter.cdxml

SHA256 d695ad7dcf3e8d05e893b3fda226f158f5e8c8e49f4670c2232247a3170fd7e7
MD5 8602ce7166de823aa26ee1ec560d501c
SHA1 413b3a32e6e49fd3a09260b8314b99dffdc1d2ea
SHA512 e393b360f2502073da8dd3414b04a5e91a01bd3968ab2476f623cf73044a50656f5873c8eb6c53ae28a62f411c0a8613c8888dec11a1c80fdbdb3fc475c1ee7c
TLSH
T1D641CC0163D109AF9176930A7691B862DA6041D3620C825974CF1B1F2F3BD6ABB4374F
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Storage/StorageScripts.psm1

SHA256 8f684d9e8e0ece29a4483bc34d23cf987c661017a3455ea99e7d4c3d739014bd
MD5 32264bfbd1fb58e80ffac3e62f20727e
SHA1 2cf2ef108fa1490cd6bb1a2df3ef93375d8a7408
SHA512 e495b13089ab48ae0531b033498a1a406748fa96307016c04e8ede781864cb200835626cfde3b48ea517491ddc3c91132921783750465239543f09fcb64a1dcd
SSDEEP 1536:E3YZAx4AKR6tla07I/Xl1XX15b8lWqJmCY52550ldaEGwH8Brstj+gr5:938OBHurstj+y5
TLSH
T13E441F192B1682EA40F2D27878ABA419FB3A11F3716C550478EDD1C02F3A915EB6CF5F
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageSetting.cdxml

SHA256 58d582d3ab5eced2fd70dc73779918551ca9cc887cb62dd7d50eed437464a1e8
MD5 9ca5ba2f88202e8f98f6b89ae51eb00a
SHA1 886c031d5db14e4bc83e36d0877ce65828482ea0
SHA512 d24186920c9be05f3eca6720f8ccfdb7c162842b2cbada154b69db32147ae2e2cb72b42353e9f47af3356a4aad09c537dc3f89fd5a9ca5415365ae975e45280b
TLSH
T151519B1416C6AEB146B9452C6AB2AC52EF3A52D3310C6450B0CF3F130F7BC917A673AB
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Storage/StorageSubSystem.cdxml

SHA256 06acea61180b8213513abd2edddf9c4533fd1543191fe6c551ba31145f8bf409
MD5 1ae79b4d2feb116fa09fcc12a4be5423
SHA1 876a9ac20d644fc4861d8f8212c7617060be9a04
SHA512 f211cac03d079517616eb16aeb3de0ab2e66d6aeb98ee5e9acbbff314fac0904682b923ebf0243c53e4c027a57d7e13e002ecbded653e8447a740cc363da30af
SSDEEP 384:6pNnZqmhmDUGDBDjDMDwLbq1ayDujFuJtDUtDeD9oLjFutpDCDaDMDsIQDsNDYoy:6pNnZqp1L0IObQrtmZ
TLSH
T14B23871423C19EF642B112297575B869DE3806E3322C4449B1DF3B17AF3BDA4B6A3727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/StorageTier.cdxml

SHA256 3c1d1966784b274fa488a5a48594f1346ebeb9530c66e32a5f766e4019cc0cfa
MD5 842a94deb96214b88eee87f6d0b1213f
SHA1 778609c0a28e980be1889dde7053021a2879e92f
SHA512 ff79cdf12046a72adcfd5b98e5c3e886dff1504e3bb14552acf9698b8f396f523d266471eaa91d2ddd3b3ec6fb88597ef8ffd724102edc8e6bbc1fcd48276970
SSDEEP 96:rYE9szJYrKr3G6OK/wIE8gKuvrE4FUN4czNVM8N4cziarObWD44w+8N4czi1X:yW6stCvJ5DK0
TLSH
T1B002871423C51EE942B11129B2B5B876EE3946E3723C4944B2CF2B0B6F3BDA57593327
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/TargetPort.cdxml

SHA256 28d6f256c55edf482ceb6e0f1c9922eabfeeb5269b7d3dc56d83a6f46f09f20c
MD5 1624f5419ad93d788eb5d4b3de5995c1
SHA1 dfc7f46af909fc2644e80b89f061133d06b0910b
SHA512 c7f26e4f426582f6d25d709217cbf71e0e4a28da57efc4ccbad3b8e42ba5a0d6c91faffa8f3822d2e23a6c2cf8f59052f790746674470d9438a7145070c2745e
SSDEEP 96:rYE9szc7DSrKkDNZqgt3DbQ2F4KqGKO52mKuCL74hd9KufrE44Njw2WqxW7uc9Jr:lDIDNZqI3DbrL2CW7URokr
TLSH
T12FF188486BD09CB642B52A245972F848EE3881E3622C1014F0AF3B376F73D955B7B667
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/TargetPortal.cdxml

SHA256 80d39f2fb8d8309c1c17b68b87db525422068f3a007ec0b862ef44850dfb875d
MD5 127a7962097b4f2c6037fe4126089d1b
SHA1 520421903119142d711a8b307f8f6914a25eb054
SHA512 1242747391f302bf5c0ba5022dc2f0a3aea1f3e53f68e097cde7424a506dab6bf9417ada64ca22ce84467a8a4991e4b6c90eacbd2876e849716f3ae4eefc112a
TLSH
T12651DF0063D019E941B971096271F894ED6915D3B1BC5518B2CE2F0B7F33DA9725332B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/Storage/VirtualDisk.cdxml

SHA256 e49e1efb59f8bae9b001e900bbc399de268ac4b66d51f2ac834ea684a8ced2ed
MD5 2ecc4c533e6d89dbf488af579e4607d1
SHA1 3a13a39d7e34129492b37cc856135ffb4b0ab740
SHA512 239893c1310aab61fffadf5a49f3c154f9ccdcf8015fbfc90667a9a048a8f7599f907dcf36b16c181064c9bb80901735014d05fc3655092bcdfcbd82dbfa13ed
SSDEEP 384:iSosO7ZqZDSoDSzDTl1NDSzD8yKDWDfbEDWDfXv6oVKpZ:iZsO7ZqI5mOZ
TLSH
T151F2960823C11EF942F51119A671B966EE3906E3623C4544B2CF3B2B6F3BDA576A3317
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Storage/Volume.cdxml

SHA256 4d440f3fc9167111ee761c9b858f7821fb9a76cd52c4805f5949a1fd14de41fb
MD5 466a544858e1faecec40cb0d8b531f27
SHA1 26fe8e0a5cbb9eb9f8cf8c4000c0cf67841c0da8
SHA512 69017384f4bc549046ba97910f8711381245c3a29313dbe2dcdf7fc7db2ffb6577caec5ec0922fcb20079e822b2b806d9ef549e33ade89f318aba655ef8c684b
SSDEEP 384:mrHQD5O2Px9PBPcBPMPSD8PuPkP1PIfyPeL:Tan
TLSH
T18503541463C11EF842B51205B5B2B475DE3846E3723C4959B2CE2B0BAF3BDA17A93727
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/StorageBusCache/StorageBusCache.format.ps1xml

SHA256 75e81a76b49c566f36522d2400cac0610a91d5fdf23f97370dc2b75c6de7cdff
MD5 98b8615405a86dfdb1b4a98b05a8edb7
SHA1 2fae57a740ab26712e78543af96ad17beeeb1acf
SHA512 2524c80c4ca558dd7a461679555ff65db26d5a3d9333d50a1ac3ad321b44876f84125ff0b43995b7b34366eb6d9916a0ceb0de6598a276d53977d677247c6b27
TLSH
T140416F0EA3C03EC519B28529B7A86776DE11610B5C7E2960F7ED470B2FB1C654133A3B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/StorageBusCache/StorageBusCache.psd1

SHA256 d516d70db1906d9543c2b6b3acde98ae98f90306c1df4d78107843d4a268639a
MD5 1f3bebe78ae063531bf50ad22ec3a288
SHA1 ae6172e8bf838ccac5ce5e55bf279be0e4cd3430
SHA512 d6f44a89407b1aed37c52faadfa2bc6b878780ea42a8b96d30c2a29f795b67c1c2021023dc283b68e375d07611f850fbe455202bd371b520e6e0c57c17a70bd7
TLSH
T17B11C622850A061683F6577BB7886DD9E6744FB7A02E0502B57E521C3FBB80753C04FE
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/StorageBusCache/StorageBusCache.psm1

SHA256 36c3d951da4db967292145edf0cda7bab12714d9a007c39b8549cf27cf1a529e
MD5 95b7175442eca075365c987ca8f048b3
SHA1 c49b81f28fab64ff5dc90b18b5471203922b2c5c
SHA512 1e17b6d04a1105261590ad418fa816909f2e658a24ef3def38521211ef75c7407d4568b3e8a53aa4076f3975fcb51eec36bde661dd0e2aca52b2709675b6a99c
SSDEEP 1536:NWcEP/0+ptPyqUUSZSSSwpSjS/BZdvSpSi:9/myqUUSZSSSwpSjS/BZdvSpSi
TLSH
T16673412A2F09849A00F3C376EED66415D73611B366BC5A84B9ECE5C12F35444E7ACE8F
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/StorageBusCache/StorageBusCache.types.ps1xml

SHA256 e429a2ff40cb14df68b5914aaf101d346267aa0af847a382750ce94fe8919675
MD5 8cca2a7900745a92260cf001a5f79bcd
SHA1 35a7ee05ef2d501abd92141fe62414812ca63eca
SHA512 dbeb07c71fd605e2d7533e3cdb30219be3c29d451c9c1993b5d103018ffc71e0f0110ad3139fa0c3d515b52b59118045581970585256fb83e2a760a9f02775cf
TLSH
T11FE0860171CC585116B00062BF22691ADB23D49705A94418B5CF055F2F668C511936BB
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/TLS/tls.psd1

SHA256 6d9a10f9c55b25d9a88ef52b2e0152897cec3ce03afb6794a6de352bdd39aa0b
MD5 3156fbf14bff1e2ccab77a507d40db33
SHA1 21d8d143edfe1efc5fd4cad21381ae85bb34004e
SHA512 38302df795bc40b06828649b6037b524bb7665fe53f66180c3f544c9fc2fbd846d5c10207a31fad53b241e88bb1dbc3169cbac5467ff5d4ff20e4325425e3b84
TLSH
T1DB01216BC94A2DB35D3A9692A120D085F37C0B6FD11E4E9BB4BDEB8C0B37551C3C2168
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/TroubleshootingPack/TroubleshootingPack.format.ps1xml

SHA256 6dd7dded2fd500f185b4ed8b2dcdbbec1dda0625b6ac0006f4b3e92b7365f120
MD5 059b2013069e42a394db5cb551e345b5
SHA1 e9238393710656a0d3217a93fdb0c2ac36918d60
SHA512 aa7118a8914944f6624134486d2bd89afd5083a4176c13392c463fb0cc502fbc22718510996a2e997df5a838b70061e16c6b402a3618f319be0641acff84695c
SSDEEP 384:8/yoo9ll7vaega7m1+IM6emzCi/N/K34a6IyuY/D3OA3JbGm:nZga61+8em2i/ZK34TIyu4zOA3JbGm
TLSH
T1EA924E2E6F903DB925138973B47C126AEF3C5D07A99E65F0B64C622F3F5090D42634AE
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/TroubleshootingPack/TroubleshootingPack.psd1

SHA256 a06aa4352dbad8a51b3a03b75a7dba9ec8397fb4fa37189a86f2fb45ca83180f
MD5 93991c9af4fd1859bb71f69e7c0ff4d8
SHA1 9cef24cfbb6c8972ea00fedfc5bba85e5ea4aed8
SHA512 5c344bb43c82e3289927ac16a0882271d3f8cec9311a9a3a14e0c5e134f29cc7640e12d006003cd76cc75b9f810bf35acb7c5fe2bad014b5c2f606ed010c4f92
TLSH
T1B1F04C94A00856175EBDD2BA51484C49F2FE5F93050DDE09B55DB3640B2BA97938486C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/TrustedPlatformModule/TrustedPlatformModule.psd1

SHA256 fb5100a66faa8ef801be0e6bebfe0f9f3b8407b9dc07c5f3935e2e7aa93f1050
MD5 7eae8b4aa8d2f6d1dac634196bfd11ea
SHA1 d7608f1889d370528340a317b0738a2d85417be3
SHA512 ac001207deadf5bdd525154c55ce279265832d1890bd7b66bda02822b8b637c76fa2965d2e8c7e035a044a144a3a411f322f5befa60d0cbe25f2a0891300f70b
TLSH
T11D0190AB9099142FA5597273E260D02572B81BBB481B991DA38D7B48D20F640C346C44
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/UEV/Microsoft.Uev.Commands.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4e29fcb6670b218c67c54d447e4b28daa98e1e80df76881200884a724e5e2581
MD5 47406204a8b17f99929e97cfa53ed8bc
SHA1 c507a500071f3eaf6b7fe039d8e8a8e4c8e74222
SHA512 8f25c6bd3909562f786683db192405e200d27e9caa41885aabd73525752ba3e9ced89bd93b47b67241b258b95ca94eb64a2c7de510f2adc2e731e0b970156d20
SSDEEP 1536:S3E7UsRaCl+zlyynmY6OgA1RduYL6Ic4PzfHf:9hlslyymXC1RdZLU6zf/
TLSH
T13283FA2663F8C30DF7FF4E78FA34512A4639FB153612E5AD4AC1509E1A72B80A6117B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

89958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.Uev.Commands.pdb

HFkiller_full/ps/Modules/UEV/UEV.Types.ps1xml

SHA256 4ca3c0bdf4beda3d56647317d0ecc8d3ad6fc3d6afda727b518f9ee8afc9db8e
MD5 e7d186a739abdceedf474af7c6241456
SHA1 ad336ef378d0b9be438f686f26f02cbb62235d1f
SHA512 09fb64bf1da41561408fdacc659daaf1531f1c415a42fceb023be10b9fa613c3c8c3720b8b124b256d5c3e48880a9099c486424d76b7e14e3f86b9d5e92a8382
TLSH
T175114F00F1F8EA560670443EDD356982EE25655F0A374035FAEE1B931F31C98659BB32
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/UEV/UEV.psd1

SHA256 7e3c05a04e8d5e7daa5634bf9aa28f94e16ca0f21107a07a472fd07b6620b5d3
MD5 b2485378b18d5b17266b7f575963365b
SHA1 9a19644b650ec00f8e25e02bdd19c2864b215d1c
SHA512 2c335c7cd57d2e19c5cc86ea37a334b444422aaa530c5c3b485433e17dcd4b4cb9dfc72172ea23602b56c0dba1fd13bb41eb8570f1a9cf3def9f4aa850513ad4
TLSH
T1A2219A1227FD5610F5F75F54AAB85C349A3BBCA8AC38DB2C45900C0C26F4D84D8B1BA7
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/VpnClient/PS_EapConfiguration_v1.0.0.cdxml

SHA256 4f5069b41e20e57de8752dd1ccff7c735f6976b41b23eefbb5abc2cb4e13a383
MD5 9f7c64c3ec8869785f67130b70ea8c45
SHA1 f0ed6c4b46057896c6038319ce3bec0b9e780156
SHA512 94d57bd795117456e0d6f9110c541e3f79d44e8788338b62f05ffbfef1396d8864a812be023a20f071cb5b7335199d47eddeed7e0074082ed76bb1df8c17e9ca
SSDEEP 192:RxADOcDfDhDOeDlDbD5atDO3DhD7DPDQDOx:RxADOcDfDhDOeDlDbD5atDO3DhD7DPDp
TLSH
T1E5F13219A3C52BE445B2512A75A1E8A0DD7D03D370AC094474CF3E079F3BEA5BAB371A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnectionIPsecConfiguration_v1.0.cdxml

SHA256 997459330be897f55c224991c7fc219cbd08ab04314ec0f81fc1bfa51cdda949
MD5 da6e89a4b56857f73b97e0a2259f3aff
SHA1 dd17b5d69641809da00723ee10ea0b70c10a9668
SHA512 7f932a1626bec09b63454b5558a35958765b4f38e594c2214950bafb4a6cc56bd79a195d915eee2870cedf93068e8860360ae8468be4bf0e62384eb6b1961deb
SSDEEP 192:8PDttDzDoDhD2DtDqDEgDl+DtDqDEny+kb:mDLDzDoDhD2DtDqDEgDQDtDqDEnTkb
TLSH
T1761237217BC1AFA501E6056565B2E4609CBE46D3319C4508B0EF3E239F3BD907A7739A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnectionProxy_v1.0.cdxml

SHA256 b86cd123b669cb821824e0cc1b45c98e7384c9478764596698a07327b90830b9
MD5 c4534dba14c50b18cc09e0b9220f28b1
SHA1 e61808e213bdbada3789186755f1f4c1bd1928b5
SHA512 6d39fc1495d32f27c1087d99d8d8903bb6295441da4e23118f99041daacf08883d8c8218b4605175c0201142f853159182a1559b0ebadc8e3d2514e992251612
TLSH
T138610F2173C55AE445B6512831A2E8A0DD7D12D371AC4840B1CE3E079F3BEE5FAA3B1A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnectionRoute_v1.0.cdxml

SHA256 1b39888baa7f873a28840775ea09f2aa3f279ec112cb47822667abe5cf0596df
MD5 5a0bb0cc5e71d006d3d23579a718352c
SHA1 995608c2b49b11b62402c4353f44c5a190dc3ca5
SHA512 4b58fc34e277630b484400bf34c917dabac71c96477229625a096bbb7c737a4fd5953c9801e5a59074635685c64ff2e3956458f6beb19473fc7387de44f747e3
SSDEEP 96:mYE9sCgizDI2D3ThD2D0UDNKwjMIzDI2D0hD2DNKwjE:8NDjD3FD2D7DDZDjDiD2DDE
TLSH
T10EB1542173C51AD446B2512931A1E8A0DDBD52D371AC4844B0DE3E079F3BEE5BAB372A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnectionTriggerApplication_v1.0.cdxml

SHA256 16cd7fb56ed6e04dc9ed32aebf5a4a6ddcf58e6259dc39fd0ee332cfa1b79e04
MD5 b29bfb35e9f4c5daf71900a6e1e3e046
SHA1 d6b70e20d3aee1835e002a082f44e878639b6c13
SHA512 74935ae07970faeb3ada33324910b35ad39743ef78a88c8b31795c111aa4b8dbf0848924462c5add61b30ca8e241f0fef40e0532198f4b20e2d3ea530ae8ed50
SSDEEP 96:mYE9sCAM0azD12D2DtDNKbDzsSzD12D2DtDNKbDzg:8jDID2DtDa1DID2DtDag
TLSH
T177912352B3C55AD446B611292161E8A0DD7D12D370AC494070CF3E079F3BEE9BAB371A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnectionTriggerDnsConfiguration_v1.0.cdxml

SHA256 c769d90bcc1dd174d0fe5ac2b9a4332e31fff17653d3bbdc84d36e56f1ec79cd
MD5 84f0793e027ce229013d079100aa2e3a
SHA1 16ca8628b78bcd280ffd176a1ecd22a822d69f1c
SHA512 fe4716f8570f36933a4460d20150d7860565fcd32aaf9909d746012339a630de51bc0c173ad640145849f6c6227adcb00b3a8760d4ea4b53ce820e96d0eb6986
SSDEEP 96:mYE9sCAizDa2DsZoDtDNKIjsSzDO2D2DtDNmIjsKzDaKDsZIhDtDNKIjg:8tDBDseDtDP1DdD2DtDvRDrDsQDtDPg
TLSH
T18EF1222173C51BD546B6516921A5E8A0DC7D12D371AC0840B0CF3E07AF3BEE5BAB3B1A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnectionTriggerTrustedNetwork_v1.0.cdxml

SHA256 d2071f450973df41c36dbd6fa60a4347e8dc99cbb9231e1459a209c7e97b840d
MD5 f8814e0f483ce841d8e35db3b9ad37bd
SHA1 4627ff064c7e983e860ae239a4b790ecef33dbea
SHA512 877a8a0282eb2050f9b7c9baadae320f68fcb91f202e9a922cced90c912192aaeb80f1401cd6e372a6f3d1d98c2560a76600378acafadb4f0d8cba87f11db5f2
SSDEEP 96:mYE9sCwizDOWD2DtDNKcjsSzDOWD2DtDNKcjsKzDJ2D2DtDNKcjx:8dDnD2DtDb1DnD2DtDbRDkD2DtDbx
TLSH
T125D1121173C51AD846B610692162E8B0DC7D12D371AC4984B1CF3E079F3BEE5BAB3B1A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnectionTrigger_v1.0.cdxml

SHA256 bc833fcaa178d0dd3c330bd0a92376d4718fc71a86f16d11449e4bf255b54e3c
MD5 dc1711c0cdd7ce2ce9a76b9218833667
SHA1 b68ed674af4664fc7d98c9b0922b2df36017a83a
SHA512 5b7651c0bb63c2f78f4aa20eb81c7f539e93ddb8716d40b2714150c6b6915a689743ade3398dbdf0a69d74ebbb4f7aa21a056f114883ba9554690d857eaea7ea
TLSH
T10521AC1173C566D049B76018A155D860EE3823C3617D0944F0CE3E076F37DDAB96371A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnConnection_v1.0.0.cdxml

SHA256 784191dcc63f1faacb881a14e3e6c3b2fd95871d2ad91543c9e590650b1866ad
MD5 5316a9a9dd734aad904b7b53f3a5f7a2
SHA1 370ddd90e10b89e8149527c01859e79e4f079e02
SHA512 3ccd08c42cbddc67cb17c61304c30e64b3e0efa165fb1bbc1774dbb4ddb9172dc219f4e03b4b552c51425ee1dd91324311d7a0e50789fb1f6f38120d135c27d4
SSDEEP 384:SDV1DhuD5V1DODLDtD2DbDGDtD5iJD5pDNCDV1DODLD2DtDGDODaD3XDZHDtD2Dc:wsCQAbw
TLSH
T18FD2FE1973C56BE445A151682961E8B0DEBD03D371AC094075CF3E039F3BEA5BAB3B1A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/PS_VpnServerAddress_v1.0.cdxml

SHA256 71813b448a93a70d846dee293ebee26d0f3d75d2601c96e8a25a954857045622
MD5 f45547e60663d7b4bc02a4182fda841d
SHA1 a0a2bbdcd7f33e988115c588bd77fa80c3de7456
SHA512 c78478485365d87e89f523615fbcbdcb3882e1795ad07cdbaa4e6730c3f0f02201bbe956e4686d060922bfea7793fa1599963ab447a329ca17dc4a8062610a69
TLSH
T1C231761173C566E185B2A1186295D8A0EE7C23C3706C5884B1CF7E07AF3BDAAF663719
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/VpnClient/VpnClient.psd1

SHA256 97ee72260e9fddf88ae3c6f2f7a851be021e0ac13e49d55812e460f42508504d
MD5 843f8504483f5b60ac10a26cccfd0a7b
SHA1 b79f8b2af90b3208e9f37417e1dced98ffc11e23
SHA512 902ffa5a85130f75ef1b4e0e283b408c5e7dbdad48417abf67c6593a7152ba78210f444db9f3c65872136fe38dc420707cab9319ad80cef739b9b8cbfab0ff98
TLSH
T1E1312D44B6A2381B771F0253E4864418B9746E1B0BB70A0DA5BB59684FBA7D037379CD
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/VpnClient/VpnClientPSProvider.Format.ps1xml

SHA256 36fa753598e1f6b20a679d761f4c1c72fd0393fc4a737c65dc7a519faa11ef2c
MD5 d1bbd32c8b6d9968e0c09e5784007fed
SHA1 e65e51d6efa425f0251e1765be374fd57da1f1e6
SHA512 18273fa52087e48aa78a9731eb79ebe76296c6ba045a5f0c85fdd4154ad2d425f9f4031c56592e1e5ccb22e6c7004a03480f371d021a66bc5ac43dbb80ffd5c2
SSDEEP 96:oEKBDnKHxfp3DSrFg0fjgq+JnXnOOEJQ9b5rbI9bEqtqbq66VyMDga9zNiX0z24D:oyHdWRQog6c+UDgqMSXQP
TLSH
T1CC03294BA3D03ED118B6841AB7A866A5DE15620F0C7F1550F7EC570B2FB1DA54233A3B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/VpnClient/VpnClientPSProvider.Types.ps1xml

SHA256 5cc1b2a29b0400d759f09f08c7987660535e377a2a68079a2342f17616859783
MD5 c9315e5df4ae253f3893ee4a9c2f0033
SHA1 e76ef4c811137c4bb2ebd57aa908ce619c152851
SHA512 6ffcaf7feb76fa2af19c7e0fe5dcd24585680498303ad3b08d4f3e85220cc906c25fc42d3e09fd7e1e3cc492b295c98d8e7bebe3cca75afe88d506a8a9b62788
SSDEEP 96:oEKMDnKHxfp3F04Ygfary4AQAZ21NsgRbR3Rfsl+7dsSvxVsiTN1sgH5HRHBsobv:oLHdw4zB4rnsSdhfs+sQsUsgsqxmW
TLSH
T1B142D350FBE8CC9041FA0113EB76F494CE24425B507BA6A9B2ACBF836F3D944D753926
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Wdac/MSFT_OdbcDriverTask_v1.0.cdxml

SHA256 df3c98a5d481d50127a85b5a0b1c1affad93f3373ce3b648156a020e49abd5c1
MD5 a258e9c3550e91e0344393307bd05cfa
SHA1 9a0d2ed9bafec92394701c7781beea6bb1d2fc78
SHA512 b5c058c43052f91fa7030b1e1384c82156d4923a1c72986eaa94eac8a6e86f0ba50683cdd7d81af320a5b4d5da72f500f36bd06b39d999475dc274355b7126ae
SSDEEP 384:TbDSD5TCRDPDBD3rDPDYDSD5TCAUoaEsrh+Io7J1FgqphnBJmEwAh:UvEsrh1o7J1iqnTwK
TLSH
T127823C2D1F952EBC05A24434B455A5649F3C1E83F0AC15E0748D3D0BAF3BEA9B6A364E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Wdac/MSFT_OdbcDsnTask_v1.0.cdxml

SHA256 4e41519aa06d4e87d1842de6681a585ad989d8ac8d826c10713613c404771d6d
MD5 85077423818b7d410e9c64e2e2c0052b
SHA1 15db622614832838ed906245938a0d283f4b7821
SHA512 b12f367e9acb39875b1da0bdeb6937f1e93959c9e294f190d0742482643b3f4e470867e702b3a41c8d91b5ea28c85fc8fb202d016a71d5ae8f0375579d2daa85
SSDEEP 384:TMD5EDrD2DSD5OZXD591RD5IDSD5TZ5D5M1cDGNDEDSD5TZXD5M1RDPDzDGrDPD3:xtjrToh7kMtR8/I6L
TLSH
T148C21E1D6BC16EF805B514787855A4609F7C5BC3B1AC059074CE3E0BAF3BEA8B96321E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Wdac/MSFT_OdbcPerfCounterTask_v1.0.cdxml

SHA256 12fda402de0d4f1711a2ec69cf21136d0a1725ea2c7bca5ee9daafdc20c7a41f
MD5 a3c38ca3455f7d7e557bebb5370b7dc4
SHA1 000326a6c6147da9ec3e96325e65f25744c00fd2
SHA512 3b7c1644b3b6d5180437da8fcab2c01052f62c7e89c7c0ede189776f53fa6739e76ca7333c28e546ab941bbee354de94196526d98401bec1559670a38a9e6fcb
SSDEEP 384:TMDbD6hDmD5TB3DbD6uDmD5TB+D5TBJoaEsrh+Io7J1FgqphnBri/XJ9x:svEsrh1o7J1iqhi/X5
TLSH
T1E9824E2D2FC56EF805A24535B05594609F3C1A83F0AC06E474CD2D0FAF37E69BAA364E
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Wdac/MSFT_WdacBidTraceTask_v1.0.cdxml

SHA256 e9892b7139c3ef8b8121c850e49fa25d844ff318fbd373e2b636cf11f94f3562
MD5 ee7c6729c9f2d4bebfdd6e49e3f556b6
SHA1 0c951cc4732c1afc2b704134eb55b316ee9db5f7
SHA512 bbf7946fcafdde5963c5f0af45783bc7c80a80c57c0fc8f240623be7496344b5a683cb023d8dea8ce87fbddfc4041a5a6dd110dc8a9c0326fe7edefaaee2e3bb
SSDEEP 384:TWD/DSD5T1FDgDSD5T1dDiDo1DQDZDSD5T1zD/DSD5T1SDSD5TLDo2DiDo6DQDSD:IvEsrh1o7J1iqqh75sWW
TLSH
T140E2FE292BC56BF844B111257555E4709F7D0BD3B0AC059074CE3E0BAF3BEA9B6A370A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Wdac/Wdac.format.ps1xml

SHA256 c9fcd55e3b31d82f4d67c45b79e37d36af7995f9d843a90bd51acbc096e9b55d
MD5 1fcc5ecba831eb5a032b04a156d2b107
SHA1 97f2b2e7c43b015e52dd3d05f4ac463bcc6ea98e
SHA512 a1551b6358277c4adce0c8e3f8421771479a5af3ba1827f64ef419df997f6d5822d63bdeb4b027aa4ad0ee37880bb01c97878e91e46b2cabade00907b8cfe3ec
SSDEEP 384:eOIgXTCus6L7cmMrzWQohTPkra33esvtFD8/G1vFZ7:sgGt6L7cpoh7kMtR8/ItF
TLSH
T126F2620E4BE13AF509718636BA981554DF28A617AC6F29F0B5DC431B3FB2D28493353B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Wdac/Wdac.psd1

SHA256 7eca1a1d48856ccf05be5c24b6370a5c851bf88467167624e2d6fce0d7a56ef7
MD5 3a216f20e999b45979768feeccbbe76e
SHA1 6981f38383fa0563ada5ecf057e8eb336025c348
SHA512 352ed90f068105f3f8ee05d85cfdf863589052e509e16a0eaffd26eef6bcb991bd91e641c97f3e5020e82683393e893b40261a74b1b2bb2a622d368a4fcba173
SSDEEP 192:WIH+h+yHkY9NivwH37cW8P2QkeuYT1bLKRoguwCsXsoz+ppjGCwzMbbXgcV:WIH+hjkY3gi7z8OVe/T1bOw7gs3zZZDt
TLSH
T156325BB90F2935890977CD41C09E5A21AA286D534DD13B68780CBC198F7AF36A7E3CC7
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Wdac/Wdac.types.ps1xml

SHA256 4049eaea4e27612ae038c8a14ff1483051f3f097264da21b1953d0f41794d7cf
MD5 73482bd36560c0568de4bf5c856b2695
SHA1 bc9eee8fd9f2491169bda0fb1444838d09d2e599
SHA512 7d7a1a185445baf739285eafda718c4e3f620f1bdfa35e70b8d84d4bf8b49ea58bb68c4bc34c407e37338695223fde9590c961c85433b69d36448747e38e221c
SSDEEP 384:xkmfTCus6L7cmMrzWQohTPkra33esvtFD8/G13FmWQy:xkmOt6L7cpoh7kMtR8/I3Uty
TLSH
T1EC52C46E9F90AC3E016A8432B9552818DB3D9D17FABE21F4348C640F7F3975C561389C
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/Whea/Microsoft.Windows.Whea.WheaMemoryPolicy.dll

SHA256 ac3b3083a7bb4c440e7cfb1bd3b77d5758c450768d2eb0d0c40ada81fc5996f2
MD5 c9a7f89cb2ff061d4abb6fa37026c0d9
SHA1 d3def2fb4b0de7488a6338fe443fedcb1755c59c
SHA512 e61a4d585fc1499a1b5158ffc46c5f43743682c92ccabc3a6a10c4e262bdcbd52f5612869b348b81a7f7d7dc919378325ed5fe62273fbb15ad17366435fded6e
SSDEEP 192:aXjRWOOyRWjdlaBeofMOzJDCNyHPh51X4PL+nxHf0PXQ5W3fW:2/pRWjfaUofdnv1IP6MQ5W3fW
TLSH
T1C032090093F9872EDBFB4F7D78561A60123DA3C7A053EF670D48618A1C127C6C9A1763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.Windows.Whea.WheaMemoryPolicy.pdb

HFkiller_full/ps/Modules/Whea/Whea.psd1

SHA256 803c5a558c5639071a64e2d1435a83ed1ab935a878cd7d3cb2a75078e938d5ae
MD5 146d70c988d192d4ad20c6653602c5bb
SHA1 b0a796155e54eee77fd8ae1c13c4a6f75ea2dd75
SHA512 c7424353974ac31bf0fdee934abc1478b82aadc03285418abb0b6adc74b9c920c2e2495524ee7c5e5ebe9addbb46c00363f0a804be2a4094b32044d43719b9d7
TLSH
T14921BE9501BFB217397F5082F844C1286BBC2BE11064972575AE85C94382DA8C3E48B8
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsDeveloperLicense/WindowsDeveloperLicense.psd1

SHA256 e443ea5f797e908f328c4fa59019972e170e2114d7e47bd6f16377d8d288d3b2
MD5 75e5569c74f1e423abe86020f1afa880
SHA1 80cd90f3f4f5f887af3dcb4bae251088ca5e35a1
SHA512 a8aef64e8482150302dad5758a27c889dd732a547b45ba07ba0a10c13cabdc57f3d45405ed890a4930647ac2e63a2264119ace2e843e61ac2f966980181bf016
TLSH
T1DE0199A824480127AA768893B80B898DF2F8AF8324088545F3A947082F33D57C3C8888
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsErrorReporting/Microsoft.WindowsErrorReporting.PowerShell.dll

SHA256 1c8ffb0519d77c91c29135623363c9ba23f6d3c15af799817f5334a97bcda112
MD5 45fec9f8a9a298eca576127316b76d0e
SHA1 6aee0f91c76fbf66ed6d7b56c198ce71eac764c4
SHA512 b003b754a0019ae04e5f287ac686cf5ed25b132c39835de7a1158d579453fc4f5a02b88a23f5081abd0a1c039762f90653014cfa090016829a1932f57ac74950
SSDEEP 96:DGwbm9B/7Cs7TO2+Nsz+ZvJ9l0nZEMSsoSKx0I+DzDgHnqMeWee/W:r8yHZJ1M8f0mKWee/W
TLSH
T138D16215A7F8452BFCBB0B3B9C661B20223BBE55AC23CB6E0950524A5C34758DE30B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.WindowsErrorReporting.PowerShell.pdb

HFkiller_full/ps/Modules/WindowsErrorReporting/WindowsErrorReporting.psd1

SHA256 d08ed1ce96c170f75a6f185b37690e269267d915a5e29bbbf4eba253e31cdf08
MD5 5e2ca764f8a1fcbbaca83e9749aed281
SHA1 602dfb2ebee3d474627cc9b38f504e7ca382f184
SHA512 af0b91ad63f2cbb28b6c0e36f7fd25d3d8748f12ab093b2635e319510dcf060454dfc35a2aaf5a495f48956502f64c17a23d75141d806086dd05b07c9a6d3200
TLSH
T1D501C038151C0116ED3E9693DA498D14F2B08B5318198925762D43485F3AA83E3C4C78
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsErrorReporting/WindowsErrorReporting.psm1

SHA256 29245ff2ef90b5f27a53019f746cb35a7114bfa9fb87bbd2fd4b036fece646e1
MD5 8220439702c9f69fa51d0852f6c9ae84
SHA1 00e0a4a9cccf1a1d5d68e450a1e8c2b1d59db9e3
SHA512 60824d2f2fedb948feedb5eac5b9a226af8ad7a0b19e03ef65107b9f60b32a7c0d43592b5b515ca4991a4e0f6c319f877501e1024b8385aadb34c45c3712286a
TLSH
T1FAC0800457A9B5D77B170747D747D4182C5476411571DD48201DD7CD0411BE832CA58D
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsSearch/Microsoft.WindowsSearch.Commands.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 957bbd2166c1880a48181cd3ca734c8db818a78972658f74f6340bd8f4ee2d49
MD5 d2b854bd9898b07ba18b743ebd79a929
SHA1 c0a6f045fa33a2555f9c71486026d7eadcf2a9d0
SHA512 2ac4a371e049480ddaff490c7403a3a8aa926dab5159bc55a108b90c73c6fcbf004286aad6627d783bfe81fae04485a19e6d98410308130d32fde9f8d1747ae7
SSDEEP 384:b6JqI6Jqoa5zVIh8hHQHI60NiU4JVEWVu1akvMZk8WgKW:uBqq/5zVIwiI60Nobu2Zk2
TLSH
T15572B609B3F8152EF4FF47309CB367552AB9B98E5422E67F084400A81933FD857A1FA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.WindowsSearch.Commands.pdb

HFkiller_full/ps/Modules/WindowsSearch/WindowsSearch.Format.ps1xml

SHA256 88d02f2ae50ce0f322a376ba68c77aec4d4d5123ae510cec4b1778268d8de283
MD5 f6703ef0c95aa48fc32d3e93eb34dd7b
SHA1 458672485e97a96e7789a814b8fc9e354301e978
SHA512 a134baa2140ab46fb3961384220a937fa00acef8d4a42ef62889dc046e42a9ee1e4496a6568a43ac3602e136b8023d3f9bfb80ce852512a6e81f432e40c60bd6
TLSH
T10B11C24AF7D12A5178B14619BBA197A0EE51B30F58BA0010F1BC1A1B7FB28F40B63135
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsSearch/WindowsSearch.psd1

SHA256 e636fc234d836d338eb563d3ac75b755c711a6831170506d799d0f1e37ee6e9a
MD5 170dcef63d057688193b5e76445d436c
SHA1 42a8d6b130f9d20917729302a2e0976fe2f14170
SHA512 ce5de281dbf0635328f77779c8c6f34a4aa7270d86fc2856d083306d8a92671e549ee15fe7490ae883d7f3066bd636b96744cea044bec0406be072a8c1533824
TLSH
T1E4F0DC89D05C957BDB7626D2C287C2C0F2B81BAF442ACF9E85ECBA0C1147EE1E3804D4
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsSearch/zh-HANS/Microsoft.WindowsSearch.Commands.Resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 11fc612c28c891acae236c9e1e0550695b27d88cf37a100224f46e1169031f25
MD5 a9d9585ed9b055caf17bd4a497def5fe
SHA1 2106bfb6822c67ddf1763ebea43494086aa7e136
SHA512 385093a097951688a9852671a7f66dfcc72c4d6198b30f5ab510c5a4f5bade8c0f5e4053bc4ae017391829264778b06987b979b91f03e1d0a8af21437a5ea380
SSDEEP 96:9q89s0vSMRt1PKIPWKufjG1wl6KeO8RV89C4iQTpSUDWMBW:9qQnWN61wlkO8L80x+WMBW
TLSH
T1FDC13F0293F91829F8B70FB0E97B4756897BFC64AA31EA7E4811001C2971B55CEA1F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/Modules/WindowsUpdate/WindowsUpdate.psd1

SHA256 dc99b9b7924588b17535ee1edb8611117b05e0177b17baf92f902bed6570fa8f
MD5 4d235b1ed4008be3030bccc5176f24da
SHA1 fa9ef454cd7a6208bb4ab9ef62ab90e373cbbfb0
SHA512 5a328bbaea3cd14425e99187617036c4ac13087612e0d2f59e8a03b8966fda206bd2efa0be50b60b05e3f43cc23aeb94f14ad459670d8954f6bd48388b2eb896
TLSH
T1D111DAD606F93017383F128BF505C53C6BE4A6B28676A750709E82D45292E25E3DA8EC
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsUpdate/WindowsUpdateLog.psm1

SHA256 f65746850b4367dd4e4167899a80f7ecff366e9d5af8453adb14120610851432
MD5 5684361f380ab3c737e78cb9c173ad4b
SHA1 c992614d588ba28f1da5b0118b78c6fb5f68a7e4
SHA512 daaba19fd0c83a51ccdf4114a63904479301134605a2b6b31a34515a5cdea381a813f65d375fda0af2519b25674ceb290d0dd13ec225172b3f6a88dd2a580e9f
SSDEEP 384:XmE5s/3s51c6Jf1AUKpsuJ76Wv9kXzrmKNB:j5sEPfdwvOv3
TLSH
T12D726004AE4A922550B3E3B8BA939A0DEB5A91BF06F5050479FDC1851F7182483BCFBD
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/WindowsUpdateProvider/MSFT_WUOperations.cdxml

SHA256 35a4f32f7775cb46e5dbf7e99e65a807df1882611e2bf71c29f79c214231ae64
MD5 4a8d2631931cc0c6f02d18d0004f8dee
SHA1 18e32f13a7b437abbec680ddc2c8fb23601c7a90
SHA512 4d71843d3320f10498ffb516db644f6049f45e83f67292fea15b0fdd73c91407a32d511367126c01fcd9e8d19eb0a6f408d246aecc797500895785804cc048df
TLSH
T15F419C1137CA97E54072E12C529AD871DE38A2C3311E048074CE7E079F3BC96BA53B15
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsUpdateProvider/MSFT_WUOperations.psm1

SHA256 80d6756ef073f309afa1d28eeecf45f35fa1a11e31fb34ed5793e1f23749896f
MD5 ac34f71ab0158bc8db6a53e882062619
SHA1 7f0439aa03c1c005e015648c47bb6f14d0cbf090
SHA512 3593d766e4f07295be303758a65204e783e64efa3735042d2f2ff73d787e82973ac8250230e145e246824c00e29ded19d26c2a13c69853316c271bf5b7884b1e
TLSH
T11921F395318362FB127FA37A5A87E110FA29C0EF5AB74400B0CD94517F3192B87A1E2E
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsUpdateProvider/MSFT_WUSettings.cdxml

SHA256 38448ca0c6a1b87a078802e187dd35182372741173b28ede0c884492b3e590cb
MD5 26c3e90debd23383ba75668ca786fdb7
SHA1 36716db1ec7d994b8793260ddaa3b3c81b47f6f4
SHA512 5f3bc68a47f1151b71f920afe871ac6afe53a8120174ace7eadb03a0c6c6a6b9a7beeb6974140dab1155712b989c5185b056073a9c52f360ab71bf2f83b608a9
TLSH
T14651433527C6ABE14572422DD644D872EE3493D3219E4C4074CE3F0B5F37C8ABA93612
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsUpdateProvider/MSFT_WUUpdate.cdxml

SHA256 d29904e8bb8ee2fd64f622fff97f0c91b58e58593517a49e110c8d685f00b075
MD5 2b36af0d26837e0f69117057bbc8b600
SHA1 2a39db0c2a902c9f839c387a9fe982d2b10a77ab
SHA512 b88a8a8ca35349693147e48d3c27572e9765532a805536a0df0b883acdd4f319f2888a6c14e4e7944501f0c0604d88a7879f346cb25b10f20ea62f2d0cc3cc12
TLSH
T1A651591463C8ADE544F59028A5F4F5A5EE284A67823C4801F3DE3B4B1F338822497B37
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsUpdateProvider/MSFT_WUUpdate.format.ps1xml

SHA256 58ef2e09cf2c1c47d09dc9af07c042c5547630cdae6d6fb94b0846225bacef6b
MD5 41e89f732f6e4b479cad80cf1ef95bee
SHA1 cae77ff99fcf0b968708e4be2fdaa92b68db5905
SHA512 f9c26be00295afd8d89a545ac109623d0a9be3f62d71bb23c804f81e8e5af3890797a30890acc85043e3170e5e91d855951abeef9fc196d04bc18a23181118fd
TLSH
T16781280F63C479E149B68519BFAC6678DD21620B087EB550F2DC470B2FB2D558237A3B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsUpdateProvider/MSFT_WUUpdate.types.ps1xml

SHA256 bacad80b97974f942758006f92e0bc72b8774714ec4f06afe22dbc626967c3fc
MD5 f4f99242adb2b055438e9034d39d4ba4
SHA1 3b84f53e15af269ea27a74baeddd078dbc343b62
SHA512 6b236057d162ebf340570f5a30bcc9e57e0252ca35a698168d7fe763378e72296986a4fc593495f48c7f87686668fc31b8d32d20f01782f3903ea6d54c6261b9
TLSH
T18F51B250FAFCC8F041B8111B9FB6F869CD10122B403BE194B29C9AC76B2D985DB97D36
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/WindowsUpdateProvider/WindowsUpdateProvider.psd1

SHA256 ace7a03deac6edd92488c0a6554bcff19b1fd1e3b58c4bc3141cf396ccf5f8f1
MD5 cb33260d72f98611f2d2776d166c5ee0
SHA1 1cb86abb722e2b1bbabe51e60e909c94a81b25b1
SHA512 1ffc9470846cdc0167044d1320a9dae1d24e6beaabac661bd796915e04bfef172ddc2bd65163c29ea5476b7e49cf24292d53be56bfb138e25535118d879cc825
TLSH
T1BC218EB0501B91A55437C3BBE4081D0AF770EFB3159B8946753D91441FB2D4353DB6A9
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/iSCSI/iSCSI.psd1

SHA256 f5f0a15b1d4efe4c67c8428a4eb535e5b81b7da5863e2da2982c2fda1eb76c64
MD5 6578a4b1364294ebf03c6084680ea626
SHA1 c7347bb8d308d653bf073df1b550fdc5b8014674
SHA512 1271b56093e7939dba564573a4be96833a179186c7de4ea796113807e4006b9a5df27bbfac41e0c20c70c06e9e87e681f8c2df202d031b5c4c7f7c9117319e91
TLSH
T127119C547C3A40B5687A7987A5286C10F6349FE3A2250B16367432C43FF25D2D29B0FF
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Modules/iSCSI/iSCSIConnection.cdxml

SHA256 a3741cc9d216a61cb356826634e73671474a5a4649ed31cb3692417056d5f7ae
MD5 32993aab6da68bc9ca166dd5d32aa987
SHA1 70bd76bba301cef163c96f2c17f4efea43c7cdf8
SHA512 33ca5cab6c82354efd56b4b3be7441c5dbb5f91627c68918bab4c4882fc2018bd3f4bb86e5b4a8a071c9fa481a8fafc54e25eafc83c0dc28c028ef84b8645877
SSDEEP 96:mYE9szltH6CjSzyIfjtKzlFnJKPigwYvKtywHtKL2ie75Kwg4:9+joFncnwYO24
TLSH
T1E6D18C0223D11CF582B66101A2A5F965FD2855D3A23C0244B7CE2B1B2F33EA666D379B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/iSCSI/iSCSISession.cdxml

SHA256 ab146392e486df12e9a3720230dab4a59f41ef15fb029ac8fb050f2309cccf4b
MD5 5ca002ad66ff66798ca3ba1e33c020b2
SHA1 0bd70e2392e20b6cb597506a3c742d7a63c63c48
SHA512 31148ea92d1f49ab29ebfab2b1a1b1c4f1802badbabf07616665d567d1a6a2453c507d9819c3ffa2997588b6fa8b9162f4956ff526555e8c602c2d87593d7c97
SSDEEP 96:mYE9szNHHzf01KZYJKzcFn1KPiAwqwhhKL2iexFKwgABjTT+6hm2yDFXZjXjT6bT:j0VJFnoHwHaAZTTl42yDFJjXjTvzPg
TLSH
T1FB12BC0263C159F586B66105A2B5F865EE2846D3727C014472CF3F0B2F37EA6B6A3717
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/iSCSI/iSCSITarget.cdxml

SHA256 7a6831c0a5624c4dfed49c5668208abc4d48a3f133b751629380cdedb4f5e7d4
MD5 81f3979f205257c308595bdaec005c96
SHA1 6b7ba93b570d99167c7ff4a4a225a3cb154682fb
SHA512 b011db8f569b0c0be88fa76379b4aa9a859fe81c4472d2e853aaf29421f2f52184cf8bd3b1f0c6d4aa7907c06cf599d5c3d2bb48ef467a6543a091f3f1b856ed
SSDEEP 384:dihj3f6cAhpDRcDyDZSDmD0IDhjLDjxDXDQDzjXjfz0TCTB6T2TsATjTrRTfTwTB:dih6JhbLOL0
TLSH
T11A62210673C15BE582B1522862A5E8B5DDAD16C3706D004075CF3F0B9F3BEB5B6A3B1A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Modules/iSCSI/iSCSITargetPortal.cdxml

SHA256 dcfaa4f6d95b6ec19a18d13716fd2fcca9044c6b8a40be5fa00a4ab91340ec08
MD5 66f5e9d01beeca844ca460bd726974e5
SHA1 7eb456e343bd4be7129b9de6ddd99b92442223f8
SHA512 a3256191197011461236ef52f66481bd67ab785288fe3daf752b713147ece23c17225317532f5f3d6cab89d8a18bfe0c7a5092b6ba280345fce982844d9eb498
SSDEEP 384:mxjOF5ZKDJDDqDTEpDDZzDHDnEpeyTCTeTsAT2TrRTvTzTHTSn:mxjU5cnpp4pew
TLSH
T12E42510573C12AE486B5211862A1F864DD6916D3B17D0400B6CF3F0BAF3BDB2B5A3B1B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/PSEvents.dll

SHA256 649d490f115d61a95680ef592aef916bd68d9abf1bd6ae4c3108f211c0cbcfe4
MD5 09f04fb494fde952dad045e27622177b
SHA1 d58fbdbe4b0e76a83d4a77594d44e8130685b0da
SHA512 b39177f656b204da27f023ad971d274c0257a3d3941cf679ec009a0fce486b4656d51a646f069888b5f373643078193e5c78a30a6b33eb85533b99ecd4dc2197
SSDEEP 1536:hyBBAbK0FNF39Vh3Q530O/VXIpJhODn58awXdA35XauG28nk3BNijH8N:hyBBApTx9Vh3Q530O/VXIpJhODn58awy
TLSH
T1674343036FED9409F0FB4B707EB982A63631B9289B11D52FB149635C9C71F80DEA1762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/PowerShellCore.format.ps1xml

SHA256 a344b541aee304edb759687f5e6b708b14b969da454e7499ee3f7a7460396ede
MD5 3d95ee339024453c72edaddf62cbf8af
SHA1 6e0a43e5542c0fcf767f1a78dfbe0b4addc65a88
SHA512 8d732b7b4a5707c61c510be0b76c5b2c369137b3a6d58985560e2d506c486b777b040d59bd3a448d7a3c9d400faaaa035cd107684287ea8600b07b6b8ed25c9b
SSDEEP 384:105fx/govfrefTJkPyD2TpdXyKex4OBH86Im9OGCBFLY5o4x49LBO76Ij:105fuovfrYJktdXyKep86Il4x4Y6Ij
TLSH
T14C14C95363EE5108B1B75A5D397788B44F2BBA21593DD9BE01AC304ECFE3D1296207A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/PowerShellTrace.format.ps1xml

SHA256 1d8df6c3347c3277fdadc4595cf1af904ac688c56d3b8376dfd49a40529a3869
MD5 d0c4d8a08e83b208cffe5355ed8eb56c
SHA1 ced8f2a37b48a659623d44aa2725e68b0e1e647b
SHA512 b1e55d39b24c4ba510b087e12a4e2672b5efe371433fd6cb3372103c78c7b6f540392a36c9419335491af156a5e82b0e9d31696eb231b06de18750f695a1235b
SSDEEP 48:3nHEKEwDnNkHjs+bpLTyaFt4kRKSRKSMRKSRKwh:XEKBDnKHxfp31363j
TLSH
T1E7815A4E93C03EE519B2851ABAA862E4DD20620B4C7E2560F7EC77076FFED554233636
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Registry.format.ps1xml

SHA256 b4ed1a89f947a045f4dbb69da4fd0a8dcd14f96c401567063c1546dd6cf6f53e
MD5 aa844c369184d6298a4e1c43e88edd47
SHA1 218e683d033ccc7fd3c7d7620e0b77ca7cd24f76
SHA512 2fafcccc69aec558c41b7444d4670717d358aedcafa935953917955db1c87607a8c8d5e738415bbf9523ed26787a7cf4eef4527186695517eb4c879e6e959901
SSDEEP 96:GyUAvnoa05fj9XcAe033T3tgVZ4idQwz260nNQ+07JlZ3l4fj:105fj9eZrs07Flqj
TLSH
T16F025E0363EE5908B1B77A5D6A76C8748A37B9E15939C76D03AC200ECBFBD1189117B3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/ITPro.xsd

SHA256 767328ad7b14ec90731e52d04ef27873ea674d34dd30297cb0fba2a11242e96e
MD5 aabd2dd42955f457c5d2e74891afb5c7
SHA1 a38a9a8a6624c5c68956cb06357f48d639e4a8d6
SHA512 2ece8eb01497407c4a948fe9439b3ac26faf712f4ef099fc0a2ddd1901966ca0d8172149020f855dbfaf39bc1a4c0d3472e2b887b5da40143edab1dc0f2ae78c
TLSH
T16321DFF89A4050117F13886735B0E044FE2420EB78B6A995F09CCAB92252D9A562F749
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/Maml.rld

SHA256 a711a691fdfdbeeef09cb23543a8ac3d6bbf92aabeec05939fca51665229e710
MD5 f74d41f1bea839b2640e383231fe7ded
SHA1 c008ebdb63e750ab52d484c96645c20abe88723d
SHA512 6b5dc83c502f964b0c3c0fcd59f6f3ed6918bc19e93923f7ebbd1c9f9747e6c3f57136212ca2c31569820233c59247589658209e1c8f10c1b0fe67c62ef60ea8
SSDEEP 768:hsq4aVGIyyNlOqvsfUZ83su8l8jM0cNM0sdcyEbMf8HqEqEDUlULcvct8gEXEVkU:y9G3vjvpAug7so/YwUtgq
TLSH
T12FB3E35177A9DA07E1A22B745CFA8B887739FC55AF03831F3085231E2C72BC58D566E2
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/Maml.tbr

SHA256 618c1a7d6abeba9fb2ecd5850e5968c6a47d51880d1a78273ee29d63c4cba91c
MD5 1b4398e5aaeefcb3fd9c2061024d57e5
SHA1 bc9b30ab10445f0a0f803287340774d23590e530
SHA512 f56ef03fc6903025042e1781d83ebce5df7830593d5f72e2f991b4982adbb20469418a855842e881760ac1a041464ae63d54bc9da6bc6b5b538be9e320290ba4
SSDEEP 384:KaKm7rH/fr3PdRjP2rLGffrL5kYn7/fH3LmT/7frv3vn7rbPvS/fjfH3LC84zX/y:Ky4bi
TLSH
T13ED22EA8FD5C5185D5422A13D973A2BCA49FFC36E2DCA9097431E7FB63A20772431C62
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/Maml.xsd

SHA256 5fb264d1440fe551365d2ede3749b6c096c524dc14b580034dd0fbc5d74c6020
MD5 937fd45115918479e8395d139fd69881
SHA1 2c7523200f5de163b9e0a1fb544e47207f85c37d
SHA512 a02a58aa352944e08b1edeeacf6d63499c4cc759956ab0b1baec4bf52ac8cc0c76f6e6f550a71413702c9b2892183eef4b8be51d63a5cc54cbf23cd3318cf467
TLSH
T11831E1ECC68450417B5348A369B3D044BE3534FF34B5A265F49DC9FA336298C561F306
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/Maml.xsx

SHA256 639e5ed55bb9fd20672c74c20020c6c96b5ff721e45e9a337133af858998b08c
MD5 4d371cbdb2658b644c247ee748bb6db2
SHA1 b4da69e8d7939669a959c75411a76895dbb0049a
SHA512 adbe5933bf9c88ed31cd296ada95eea967a4ee1ed0efa4b691f04686aa988aca0b7219c803684a66dd75f859acf524767ffdbddc9debfb7c927a4220dd4bd88c
TLSH
T11BD022E6A240AD330B731932C73AB86B63F4744B81B91825A88780A76B706B8030C4CE
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/Maml_HTML.xsl

SHA256 90eb38c9ad75c164fa9cc413f6a200b790692587fb2f679ad1b7b14821536577
MD5 9c99eaa85cf57e182244c403cc1db334
SHA1 2fc1e7d60c862217d06f5e9abe347bbe79e0d0b7
SHA512 e2b431a0af1616cb808ef0b71a340b1a5891da448e5424865a1b88b2ab2f34b03ae07fdcae8730c79ab8c134bf08aea0c6ff6488db435c67dfc74c064268142e
TLSH
T1A40137531AEEA214BAF67F2A7E7650601B737C42EC78DA9C026C1C0C9B97951C431F67
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/Maml_HTML_Style.xsl

SHA256 bf908402a044e7261bc8a23718f6986a923f6499d2ce38b81d6564f8305aa267
MD5 f335660b192b3b2e004b1af5f012d0e2
SHA1 14ddc6b3bee531e6e4cdb8b0de7f1de598c754de
SHA512 b47be1dec5b17c1049334f9463211fcb59f11bf68c94b843555a1a53d499053f90381e23e433a8c03633002e0709fa745c2ac737b91b657aebff5398665c5e98
SSDEEP 384:ZPR9+mU83+Wg1AwInfrCcO9kF6eOaJ+/L/8v22Ja7nlBDIn8:dzOA+/L/8Gd
TLSH
T13A52CCB2B58CC73E0F586117C9B92441E71FDD7A62362490F2EEE13B014EA0C5769A2B
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/ManagedDeveloper.xsd

SHA256 333990ca8818c059c171d5f8936b23c26dc028f8d6625836c7ef7a2e0575db48
MD5 c596685f215de008b4ad9dfbbc05caf3
SHA1 01be95c0252e29f4bdba62336c7beba2d21a1b64
SHA512 697d54605fb243db5cb747e0e8e5254e39c47392bd2b8828739fcb1211dc104b0b15a441367f4811052efb0cfce91879d00b8711ca515e45189ccf836a022146
SSDEEP 384:LGS7IqHxLBircUm89CIH57IMtyTUm9CcYIZf7IQTUm9CcYIXp7IqEzyiOUm9icYb:D7IqHxLBircF89CIZ7IMtyTF9CcYIF7M
TLSH
T12252485176CB16A2464F42172933914F7B2BBC6EB05F3856B48FA2772F32E78321750A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/ManagedDeveloperStructure.xsd

SHA256 d527564e49a3a5c8ea6ec21326affe99c54aceb8adf891c3cf1550a0e98240d1
MD5 4f5228b84d9bee59c86ff1316eff7f4d
SHA1 9f90a56644075e2911c98a56019dec3e0be68115
SHA512 b960f3d8bfb2f5c46cc4019697fca1484414157d3bde64fa088097324406c9543baa7238b85e3f96635fa223269652ec85fe9c174e2cea8f1afafe1dd432f56f
TLSH
T1FF610ED8F1851D42BA1794172973A5C4F93678AAB17A2920F08DB3732B2ED7C331BB05
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/ProviderHelp.xsd

SHA256 d282204df33ffbbc2e2b097a5eba9bdfa068ca2bf3d16aaac0e62cb7c3150671
MD5 749b1b7d6ac931c6e67ccf6f2aef6753
SHA1 9428dabff1f6e3fba850d5d497a13bce5f23db15
SHA512 ed886d44d9228be5afeaf818dd5b784180acf3d6b1de6c7422384e25e374585b1d81ccab258f1193629dd042b7803a7b0d1d02d7cea7e4bd0756e872fdbb3c73
SSDEEP 96:MvfXPiftqIUNrPOmrPwrPtrPTXqhd1rfMGt1rv0srDDOSuM4r9uUW1rDgudTM:mX+47ZM
TLSH
T12BD1A24A70C2CF0646349D3216A2330EFE905573229A757575DCA7232F36ED268B76F8
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/base.xsd

SHA256 b860ef30b01c57486a56948800e9b2da116ec473cbecbb33fa9f71b8ceab90ae
MD5 87443e23ad81b55a0903ec451c1352a6
SHA1 60c871f3caa20b3f9985efc42402f87b5d0e0410
SHA512 70c97297bd17f5d3c156d38c76afbe09fcbb433b5f55330e1000d17c76440cd6e4580dfea006621e0ce3339a96a5ed4359223a643fcccac33817b7e003e3c64d
SSDEEP 96:34SQZ4rk0V6yV6Vhn8FgJtEjgP6kzIC8WzXTE1WRmtBeEzKlr:GZAk0Myc78mJcOIC8WzjE1ftE0KV
TLSH
T177D18AA13DC05A622F77881B61728480FE7490E7A2152598B4CCA3272F76C6C77FF6C6
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/baseConditional.xsd

SHA256 d26d4ef29124b2f9107b167d73e611f649fb2021d30c48a8616c6cc96230de81
MD5 d2621ec3933f11445219dac8d35ae3eb
SHA1 2daa05e7324766a5f540c80e2e18f6b13203abd3
SHA512 9b7400d09e683327730d5e97ae53771ada7a63661eee43d78ee79d734e283a375579bb18480dfad5a645a1ba32ab3bb7bebcfa90dfc3a3c85f298a346321624a
SSDEEP 96:3fxQ7U+FSVFeFpMIiiGKYGQo9zw/WwMGfw8ADM5SmsISirsG7DT4i1Az:GzMnKYGVwMG48ADM5SmsssG7PB14
TLSH
T195B11E8579E0A8155773884B52B71D52FF3C44E7650A4458B0CC8603FFB392A23BBAC2
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/block.xsd

SHA256 9a8b3c184394711480c38d71db4850659b87729df9eac5a2235bdcf37a2020cf
MD5 2596ee1b47bfdd3120d2523552c77e80
SHA1 080766bccb50519a1ce40ea69da7517676755179
SHA512 32ad10d107d0c3d40f6bf098a0941a3a6fb7f17fbea0147462e752728cd1cdd216e167e7ab58c6078f5d545beac6bd30cf7f90c86413f2d3b83862f94fd672e5
TLSH
T15F11C0C4A8D151A126F785A271B1D140F925B4E7A1709DFAF089C65F3738C9F312774B
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/blockCommon.xsd

SHA256 928717b190b014f271c09c2ffb7633c1e660b26f0ecbdd926662121914795789
MD5 12c1dadc5f4eeb42ae3b66cf72c53608
SHA1 d3744dfd0a8fa5ca29f97f441204bddbbb64a6f5
SHA512 0e5d3e4f6ebc9d47aa796292fb16775bcad9b2dfa8dbb03903b03d383e8ae9531c1d8e6e52cdc80f7b3e3359ef055e05ce9f9833cc498e234c97bbcaf41ed456
TLSH
T1F481DDA479C206516A7B891331728145FE31909BF6032D55F0DD83331F36DBE76ABB8A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/blockSoftware.xsd

SHA256 88aa3462598b7c394350f83ef366e5f83885c50a9c6966f02179228277358334
MD5 ede1571b9bcd71a1602965c9625a05f2
SHA1 f681fe895fc3dc66534ff05bab005c614b8f61ec
SHA512 7c8c6239586b92f8be3bc48046fb65b7511c48de882dea733a9144cf04a4963212b5919fecdb733edb5cad8d9daa57e3d62def2a191cb6bf7f301caafc1e7e19
TLSH
T1E92110C468C01511B6A7856371B1D042FA32E4EBB0769CB9F0CDCE2B3225CBC701B78A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/command.xsd

SHA256 cb0bc72f1db11db895c73767d53961ff2e2fa8f8b00b6ae14f12bd37a6bda5b2
MD5 47b972d8df4e2fe15ae6281654366ed7
SHA1 9a39d1b45c81783fc01141b275e8ff458cbe14e1
SHA512 787be517bb7469d3ed18e84be9721bf8dba3e28befa1d98e6a254574fd17c4dcf93c556219335d3ef51661a3769f905bffb825d12970c63c911e861ad13fccf8
SSDEEP 384:yOET7KTHxFmYWeoxZwLIYTzhLcE6Nrn6SzModjj6YsAIF5odVTfAfrgmfAfr7TWb:PET7KTHxFmYWe1R6h6SL6YsAI4fAHfAY
TLSH
T15C42D17536CF6BD70A4B4A1360775008313FED3271192012B0F9B33718ABEB5B666BA6
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/conditionSet.xsd

SHA256 506415cd77ede25b33c3e28fb89012b282e90b5d01f266323a83fea9625f8eab
MD5 5fee9d210eb321dafed2e687d546cfb4
SHA1 0c6b63208764db82c7a058d01b422a1943ece695
SHA512 5d9a6e9074adc05cbdfdf94a80e63bb6001b0512ba1ac49825d7eb725f1660860421300752172e051bcb023a18be84c246d0896246bb71d409223aa0a86b0c88
SSDEEP 96:3fxQ7U+FSVFeFpFI2/iSVtP2aCV5DTIT6ijdMDT/TfTtgHYHaDTAqXp:GzFfvmLPM/yPb7e46PZZ
TLSH
T16491DE76B9C61D032A3BC42326B266C4FE2091B3B65D5810B0DE73331B3EE59691FA19
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/developer.xsd

SHA256 ab9a7ddb85084f331ed79cb34374509767d9a64c510b0264682d5e682dc59497
MD5 cd407f79f5927ce68bfa6d303e67f250
SHA1 0ec6554a175ce05dedb72a8246ae46d341b2c409
SHA512 5077c30268eef577f1354ad128e634e158db201c0bbc54d0db6ca4c9ba46c3168ef7534b54268baeb8bc955dc6baae3cb4827afd2b87b894511c8149a4d11e8b
SSDEEP 192:P7zzlPaDIAHsP/X90PSPpSvPwP+ZghEcIQNx9NBlPyPmZpqPGjCEP9PBHGefHEFD:QIAHsP/X90PSPpSvPwP+mhEcIQNx9BPo
TLSH
T1E232035575C34E438AB7CC2235722984B923D1E7B24A3C11B0CCB3231BB7E55756B7AA
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/developerCommand.rld

SHA256 cd8a9a6b113db5005f2a5c8321e52368411691b5f0c5eb90595e2a97b0fdee89
MD5 a0a72712f5a86e275a1d196b39e26481
SHA1 bb2da740492249ae07d189b4c4333ea4edd16978
SHA512 8d76d5aee3114f84e8d5c44073f9c18393f618ee147ba3f405d6bf0833f9001a43d5d98b7be120773b8f4591562089107947dd01e52dedb8a4739ff0f555ba3e
SSDEEP 768:++sJFIg69BipuF2ICCN1lpDUb8/cdcwkHElEnkS8p0305s/UJ8Us+8l84MUcdMU8:M6y9hy1i4OZeH
TLSH
T1C9B3375077E9CA07E1A71B755CFA87987635FC14AF03934F3086233E6C72B848E566A2
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/developerCommand.xsd

SHA256 bbc9b2dd6d4473f09ce95a4e44b7f654a8d34a70197beabacd1c9ff5233c3dec
MD5 65a73204e2ecab350a6f85a542795d17
SHA1 04fb99098ee275a63f01c6326f9882398b961130
SHA512 4c83c718072e07fdd33d0b4a7c8d1f5a2f3a60a88a9d686884a9e4183276258fcd1b82c01d1bf9348e4d933d32b17a242aa6610927811d088bc74ea7aceb1118
SSDEEP 384:ZyP+ypc7sdS8h6Pxy+jzo+hJOPpF5fPGPqPpHfPIPBPpiU0qERdmPQP6lPGjsPWf:A+ypc7sdS8hqxy+jzo+32pv+6pH30tpq
TLSH
T1A662DB1138C78F1742B6C83132B4190AAA72D197714A2C6270EDBB172F73EB171677EA
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/developerDscResource.xsd

SHA256 d612c2068540041bfa636f1f8eb3df8a6d236eba83de9c6e314dd75c3e871928
MD5 0051fb2904a57db9e8155cf53c66cc6a
SHA1 521c6a3cd199c6c20a7ff9ca14e9d443b09e52d5
SHA512 95d6c7de813df28b016d2cd0d3ff0a80508ea0d53ea647cd9ce288a57448796e00e81f878ae249b3038591bc11c5f859c87e60209582466ad29482bf777c657a
TLSH
T171510FD5A8C688016AB788233170E505BD2065E761B6AD19F4DCDB3A3376E58601B786
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManaged.xsd

SHA256 5585fd25ed4fa8d39b75e9a83082eab1d305b00839e7bcf05a24530e3d91d6ea
MD5 1f598e766765ea10cc9f008bf39e0da8
SHA1 276bf4341ec142c96e37c0d43dfc67260ebf017d
SHA512 f4afa676e7e514743966c5d2e20772f1ad4577c0a2704888720a8f8fec4a39fc5f5251843d5bb51f6c8fdbabd3ca5e77083d60c6a16f48f95e96a321c3692976
SSDEEP 192:PRztz8qPpSotGUGoPpsVPWPpFPcP6pIPEPpSdEFWPecQ0XPhP+sGY2vgn2gvZ/gY:BPpSsljPpsVPWPpFPcP6pIPEPpSdEFWt
TLSH
T10622E1A576C98E1247B78C2772115884ED76D0E7B2462414B0CDB3231F3BDA562BB3DB
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedClass.xsd

SHA256 4cb1c23d86d22b4bcc5aca98cd309c37f54a30358d673115d460feeacb78df9a
MD5 a7c0adb98fcfc70dfc9044a6566b20e9
SHA1 29174bb82278d57324da327f05d605a7b15c9f3e
SHA512 cb46cca0741c1de5eea79c5f475fbe5bc78b362cc431070b743054a0d26f58cbd20971578ffbcd766ce19fa2fd381470425b219456b1459a5b87d7bb32c06a67
TLSH
T1CF71D0E476C549016B7BCC1731729508FE7210DBA19A2915F0ECEB372F33D6462AB396
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedConstructor.xsd

SHA256 0ca55a744ad968b537742ed37cd62852df01cd96533d4e17874ad4f75271c8dc
MD5 dfbeea4cc0234ae3e3f39182b6c99b9e
SHA1 ee41132ce59216eccfdde0a23acf5b58741c23a0
SHA512 4691d97f487e250eb2c97c052ef7c0acae7dc006f8c9e0f70d9e4dbe52392e25a2aae0ce952410b7a2a0172860d4f03a60ab046b62af22a7c2e37348f82f8a6a
TLSH
T19151FFE4A6C54441BB6BCC5330B1E108BE2210EB70EB6D55F0ECDA7A2773E68625B395
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedDelegate.xsd

SHA256 961daa1c4b3513b83cf2e37fdb1361be0d123e8b2cfe7f32510ad534fea98e3d
MD5 66897108b6695bf99367b9a08713da56
SHA1 3b3d1c4e855b47130e670a17fe136cfc3edbdb75
SHA512 7be4a3fd461cfa8172a7c90c074e11cc73e399db84282f68b569720665f54b944fc662ed11396cb16c24609e370c898b172bcedb9c8097b21b8332789d535b3d
TLSH
T19551E0E4A6C50401AB6B885330B1E108BE6210EB71EB6D65F0ECDE7A3373D68616B395
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedEnumeration.xsd

SHA256 3ab7329914d7a9a6d711a62405089e736ce714ee4de72f3493222887a72fdd39
MD5 ae65eec9cba5a7e5136a5744edf10026
SHA1 48d0d14fae1e0193d4680ebd19c8cbc00d021814
SHA512 a66cc1d1ac9bcbb138577dca86d5848aca7d0c3b8c3791def7892c5cbcc3159118fadbec0822262d36bfebe8aaffa140f6c36648de97fe8a6157f9ee9c238e5e
TLSH
T1A441CCE8A6C44401BB5B885330B1E004BE3254EB70E6A965F0ECCB7B3263DA8725B385
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedEvent.xsd

SHA256 93ebd3af5a078830839b10c9db753cd445dc2d1a78a5449c90ac605e7ffc397c
MD5 d4b2f86d45eb49f3898c3dacdcff04c1
SHA1 c179eb7c7ac7285a3cf904a4a605db7db1f71722
SHA512 b89046f8ea33e1709d1cc8b21bf261744601460e710bef10680d8019e250c2206713720cf77a88547917230d8de4f900f489b26a9ef25723a69869fa7a3b1a06
TLSH
T13251CFE4A6C549016B6B8C1731B1E508BD2250EBA0EB7921F0FCAF3A2733D64615B3D6
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedField.xsd

SHA256 b17f73add6678c4bc259065add380a9070531bc24a66af3c4cad3cf3d811f3a5
MD5 0507f8d0a4b6dd105cb089814df7613a
SHA1 488142735d53d2350c578750c1f22d7ec16fcae2
SHA512 8a5c4e89322434f081b75cc7c692d723d785ccd083ab63434645b75802d1021f3d455624a9fdd31f349aa3bfda0402133fc44da72fe0e5b3470403f3103c0d7a
TLSH
T1C75111E4A6C44801AB6BC85331B5E108BE2250DBA0DA6D25F0ECDB7B2377DA8615F395
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedInterface.xsd

SHA256 b851d8be146f1f51e5857045c28726585cc96a29c5a5a57dfc86cf7c509d8234
MD5 1920a6f874ffe202e6505e0be318c74b
SHA1 d55cda3ec3ee1361c1114c2d51fab803d574b871
SHA512 0fef27b73a8fb5fdc6b64fbae407071c8131f5868fa31155e8b7193b24447d9d18004392793f15fd92223184a78be4df50b811e16dc0c07a3ed7b876c27345ef
TLSH
T1AD511EE4A2C514016B1BCC5331B2E608BE6250EB60EB6825F0FCDB3B2773EA5615B395
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedMethod.xsd

SHA256 36eb2bc76b2cdbfd908df62e16ca915f7490ce75cf7bc386974ef89aa77b32ff
MD5 1592294a4c92d16be47c4e40021c579e
SHA1 49aa7c195d38c0850947b693ff38dd4a1d1395f2
SHA512 cbee0268dcfa484aff0cc3dd5ae735fe45cf37245513097521947a6af7cbb13329e147cc88314356ab59bf650b34cb24205112d41dc473db563eafe8dd8c3bbd
TLSH
T1F751D0E4A6C50501BB5BCC5330B1E108BD6214EB71EB6D25F0ECDA7A2373D68715B395
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedNamespace.xsd

SHA256 68d68d8cec8181c0c3046b419426ee1bd4d0371abfdbf9a6789755b0f5764d91
MD5 b315822cf88f8f4d0b2cc227af4cfdcf
SHA1 78f87423e2f74214a6981bb3a9349bb544eb76dc
SHA512 e3d748543b21dc5c438830a87180fb5c46348eaff09b21fee8e5f65774ade3462d6ddf73376d4b5c5edf9d7dd97495321c2832cb3bdba08baef1d973cdcc3f55
TLSH
T1C061CCE4B6C94D415B7BCC2331B1A504B92250EBA0EB7811F0EC9B372733DA4616B7DA
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedOperator.xsd

SHA256 053c18557be353860222e14d7ce5e5844f5a746ba45347a9e08da1d5a2b29f3b
MD5 d40b195d62f7455712429917ddb0bb74
SHA1 c3da55b2c51a820db4cac7d0db6b36716d8842fa
SHA512 c9734deb6e7d92f1e2b176810d964abe48cb71ed88aa66380f3c3d79c7d6da9703c309b3aebc3d6471e2d6c5155cb24a980f7ee96ba2935777f7e3c887c02e05
TLSH
T18441CFE89A8444017F178D5330B1E044BE3554EB75F6AA95F0ECCEBE3056DA8661F345
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedOverload.xsd

SHA256 7d2695d2f6ab6eb3c0bab6125eee415545c3eabe0923b1b37519f2d4a8b9251d
MD5 c7a15df35a97609d42ea2abd16f2d821
SHA1 a3574960f5ef897d40bed98f39a4a13db6dc4f5e
SHA512 28b3ea35c15c5778e85771b45949bb197c2a3a3bfb8b7999fede3de5fc28195939951934b99fa83d1907d312338babc885633cef5c83331daecb13b5d7855843
TLSH
T14A51D1E5BAC488017F678C5331B1E104BE2150EBB0E66955F0ECDB7B2233EA4617B785
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedProperty.xsd

SHA256 832a25485eaa9060868e9258aa1f93626804ed439ee2b43b2d74f9cb0dc438c4
MD5 09516c0d1752140f05be39bb7e49044b
SHA1 e7c6fa329828e82b8372b9c79df39e9b8ba0da37
SHA512 c1490e348af1198dad78baa2774f10e6e73ca7c5982f1656e747057e0d3471093cfd6d7c16a465353daf41c6799ddcbaee7b674a436268d8f5ac8c953c945132
TLSH
T1E951FFE4A6C48801AB6BC85331B1E108FE2250EB61F66911F1ECDF7B2377E64215B396
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerManagedStructure.xsd

SHA256 b7d1f7ddbcfef43bd171fd78d5a255089a97762ad67c116b6a6998815905901f
MD5 18a21baec77f1ee3a9911a8d0ae39d92
SHA1 1909fd89bdec2100f0952d4c4addd84212ca85d6
SHA512 602c94235b26bc8d129e96abcb0e573fe31727b01217ff18481480b66e7c799a0de7140cac45ee3cad544ee245597b7e19cc7bd2cacee8e60745ec74635d9bb3
TLSH
T1C35101E4A6C54901ABABCC533071E508BD7250DB609B6911F0EC9B3B2337EA9615B386
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/developerReference.xsd

SHA256 42c585d48c418c7eb47cba298a147923597b967e236997bb815301b57e31cb92
MD5 76ccb5c2f126e23890661346440e653c
SHA1 351227fcb720aac1fa294dce35a95d71e25552dc
SHA512 4535ed0c91dcf442b0379566203c83b79e7b725359eda5e187c450935b718ced5ed9044b06ebc66e78b80162a212421b4c7db76ad759dbb19a9769afecedc196
SSDEEP 384:/tY+M8aaLjtx9Od4SbbBGhr3NTF41LUtF9G8oPnhS1dN0zScj0JueUgE6ExEeYOb:/tY+M5d4w47Zm1Ibg8ofw1dN0zScj0JI
TLSH
T12C42995AF5C359425E3BC81735736649FE3251F7F20A6820B0ED63331F32E68626BA19
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/developerStructure.xsd

SHA256 d1c0e02bb7207095e49efc216a574b596a82e97b88e686e1c7a9717362623c44
MD5 8f213db219eeb81895929a72416e0380
SHA1 5c4c79a72f82e91a2f2132fd2adb16e5737d93fd
SHA512 83dfc679186746892875e350a9b531587469d10394d6714769bb0374d1da533a70ce5a54e0109f6f10b36aed582558f28a1d0ec76e4fc1dae30006c18ff7ed94
SSDEEP 96:3fxQ7U+FSVFeFpGg0C4HCiKmCRSQTATJTZ1TPTKTaTUgzp8D6JT6pQoAz:Gzty69jUlZRLO+UgV8WlaQo4
TLSH
T10F819999F5C22C421A37C8173172A6C4FE2591E7B15A2D60B0DDB3332F3AD99552BB05
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/developerXaml.xsd

SHA256 83ed2ee26cf6ab4c95a880f1424f7d5e09385b71239b84b3cffb58288eeff3b2
MD5 d00e375637fad70110aca202af39975d
SHA1 ff3fbbcf2063f7e45ab1a310557dd36d64ce4bf6
SHA512 1f8055cd1484e55b0f89486a77b455eb4bbc7b965096ddcd9351ff2f4cedcb3c99116fd63bf204df1c33546f70ac112479ba116240e0996fcb1ec7e1d69aea96
SSDEEP 192:PgzIAz8lDevsYrrvsYFZvsYJ9vsYJXFvOXPy1WP4PyA6b9XQrTPZiu0PmPp6yE:xevsYrrvsYFZvsYJ9vsYRFvOXPy1WP4C
TLSH
T151D1B0A4B1C68E035BBBCC233261E48EBA1290E761473C14B0CDB3171B7BE9524677DA
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/endUser.xsd

SHA256 20f6249b11c4c43623164d18daa3b4462e1e7d89038732d9b6a02e8767eeee75
MD5 1380b2c0cb4ee4aad2976a5a9e40fad4
SHA1 6204bc3fe05ae94fac1827d5fc70ab796d2f75fc
SHA512 f47e33d1a0b34568647d26f31a24ad9f8e9b93aa43f0408c99546cad927aaf13613ada55c04414f2ed81311703423d210ed0027c8f16e0cccd1e3332ab5074d2
TLSH
T12B41DFE8B5D486603737845331B3B404F975D09AEA252C15F0EE427B3BF0E5E12AB345
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/faq.xsd

SHA256 9183b6396ec8261cb70d9d1b8a1e7f28f98c7cf65ed43a70e224cfff54eba0c1
MD5 e8d12fe7863f4a973dfc59c3fecf8bea
SHA1 a470d58393b3bfee65d2f28cb0b3a881f494b542
SHA512 fabfa9856b305e270d025f19d16d0328a7f544afb12fa4bbdd98b832b77977cae297484c5d25dc1c3dc23a71cf96a7af4d354a863817c416230da962c49224a2
TLSH
T1AE819C9574C24740676BC9233072A709FD62A0D7B0532C25B0DDD3371F71E7A26E76AA
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/glossary.xsd

SHA256 553ae3f435e321c383cdd5f4d08621ec48f5a1531fe5724d8464f285eb6ebb62
MD5 d6f7296c2a5441118fc703f2ac894e30
SHA1 f0ada5c2e4d2de9df20719d8c9baf04c7abd37c5
SHA512 d6823fb7b1ca873b2b9affa5ca9be58267956cda2f8028600ba8fe1881a1f9c6c8d63410cd6ac16423cd5d852bc5421e04ef989951434f81f0cff560ed1f8c86
TLSH
T1EE417DA439C147926B7B882371B29004FE62A4D7A4136825F0CDC3771F71E7B26DB78A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/hierarchy.xsd

SHA256 d50d8096a11350a8e3b6873cf9cbc173b8a4322324b16f949538b1b98857c5b4
MD5 06f631abba1e6a1248b6a079f7bbd888
SHA1 7d22ef7c605b686fe3248bd3bb5f82a191ee0cee
SHA512 0a7dc455ddea735a40e16dfa45c7cdfd6933c262a07679f052bc0abaf134ddd3abd5635df5a8681456151d83f7f173e975693bc28d1685dc4dfe2b9837ea66bf
SSDEEP 192:Oxi6V1mPGkZuTAIZfGkVsV2NP+O/GaEOPGkZCbuEqq:OmPGkgMIZfGkVsV2NP+2HEOPGkcbuEqq
TLSH
T11E22EEA478C147422E77C91372726349FE319097B1122925B0EC93371F71E6926AF7DB
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/inline.xsd

SHA256 5a1a2d4586203bb3d6a4e6ec93e4d09d0ab66d33539b88a2550a36100d1e16fd
MD5 0f1c76ecfa37e89b9926761332af6b87
SHA1 5954a1d11ae2b3866b068e43fa747f3f6c418c1d
SHA512 6f8d19afb006f662537a59997fec26212d5d3fa573b3beecec6b6b9177028eaf602035dd711993a803d6935866158e6cffddd632d2d4dba3c55667905c3c1a2e
SSDEEP 192:Jmyc9z9bcNBLgfnmpLLPspKBGnlDPR86mwlb5pN+tFYlCJCM:w1cvLanoLPsABGnlDPR8Xqb5pNkFYg8M
TLSH
T133F1C9D87AC246416E7B88233672A245FE2191EBF1023A24F0DD93631B36C6D765F787
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/inlineCommon.xsd

SHA256 02071402b963966ad574ab09bb42719bdb1ce6cd7e9af260a13faf9ebb580c55
MD5 f15134d866ac158aaa5a5f111727373a
SHA1 440c84e7818797222f8d001cd5b517b513ee9fd8
SHA512 e0d68efbae5e80655e471e0436901818740d89b5fa49cbd8f025211e7724eca12cc620f01ae92c75ae22838e0d01526aca141e40b8b5ab561cb00fe9fbec9e8f
SSDEEP 192:pDCXC7CNCWKXKTbcTzXN9GW9+J9C3CMKrCczCACuJPOyjcv8rTD0WihvQZ30KCbl:pmSu4b6TKzXN9l91yh+c2huJPOyjcv8U
TLSH
T166024BA479C24941AA3FCD137572D449FE31A0EBF2066D21B0DD53331B71D7836AB58A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/inlineSoftware.xsd

SHA256 c444cd1121a8b83b0ffe5a8467cc10d2d810c5a7765f4b4406d1eb329cd8901d
MD5 1148749bdb17974e0c86453e962ae12b
SHA1 65af98e4bddfc93434f745a1a336c9d66f4c9196
SHA512 4be6f1bc413977168031ad2faed57919eb0a803da47a0904cc7f1f888a99d97421718725685ebb1c958e81a5a68e4e8afccab50f3474942be04d9c73be8462a6
SSDEEP 192:2C7cC2C533bCNqCbCpCSCgVRmC0CrICiClCMCNgc5frZFZH5YdMIrsLma/:n7lnt+ROcLuR3Nr57g1Ngc5frbZH5Yda
TLSH
T189F137A47DC15A82AA7B8D1375729045FE3190DBE6022925B0CD93332F31C7937FB68A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/inlineUi.xsd

SHA256 e7ff025576e482632878709e208b95916ccdca2af108c1c7b9218fb8472c1ae3
MD5 02e7a40956815817a874eaff6c1c74df
SHA1 b475414680d41ea2e415dccc792a6cf8d13c9494
SHA512 e3d93daf4c4697c4a37d7456ce77361b827d3b1b197ad3b9624f919091f3b45c091234595129bbd4d47472e83f0e59bde251bc0ceffe00bd662c5874555cf813
SSDEEP 96:3fxQ4ZKTvTZVTqTRR0G+h+SYHmL2aqTcTo3gSWScDCTQpTfIATdTGTtTGTRTpTj:z8rZxu3+9WgmYfIUJK5K9Fj
TLSH
T1FDD18CA479C66A51AE7B890371739185FE31A0D7A1032869B0DD93231F32C7933FF58A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/shellExecute.xsd

SHA256 52f48b0830346e30c782aa5c379dc547d0f40265ff1504276c904b819446409e
MD5 2b192a6323bef9b4a18602bdb406b91a
SHA1 002b8eacbdbaa1f2ab7f50a452fba127fc597249
SHA512 4d29f1f9b5cb5b0c59239863a36e99d0dc51afa67f123583900431aecde50bdc9a191d7d29c752eed30f9b95414261181ed8c9cec3de45b856e815d9c6ac4709
TLSH
T10941255934C58741077FCC1272A1A14AFE23A16B62126811F0CDD7271FB6E9B21B37CE
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/structure.xsd

SHA256 f35e24830e9e1a6ac79dedfbc3f2ef03eff8d41ef8c2414e8ba1c1a52e527391
MD5 256760fc651c72c521241012b646b064
SHA1 41300d22ba519e42355f261bfc6c107eb6298c06
SHA512 1fa5b4331bc5cefc1cbf19c1944d84a9aec47e5e86db1ddc874e3b6e955d86904f390f868319f2b2aed303f38832a4875ea8afd1437107c5357c8969f2b0a013
SSDEEP 96:34S1d9vYucFoxhqdTVWgZ2+KDJZdl2O8lvTMTXToTfTKTQTiTA4HGPTIRHlipwVf:PQBoxo5VZ2+KDxg2js7OE2A4HGPTsHMU
TLSH
T117C1CE9078C356815BBBC4623172A649FE32D0E7E1062C25B0DDD3371B31EAD266F78A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/structureGlossary.xsd

SHA256 4425e365ba3b646b11e5625644d5f98b0151f60ed2ba0a28316570d7d68f6fa5
MD5 db5c5acd6f6d0e648a74095e9a9a0155
SHA1 219c41ed67f7e78029f6b38d86cd3bc926214bf9
SHA512 871a12af66df39e94dd412cb0561055fdfeaed247dfa37468e9a3181c66f0b97a0727bb91beb15fce8ae07c223cb61e1f15ae2055a42f8f474b918d178340f80
SSDEEP 48:c84Soo0wU/RTVT7rrTBRSfm9ylJfLT02kOVXJOGnkMS2m62DOMyDGpgqXETNsjpV:34Se/RTVT7XToVLT02tV5IUCgjubT
TLSH
T1A48147E87DC04A51AE7B892235B29145FE20A097B4133970F0ED43671F72C6D766FA87
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/structureList.xsd

SHA256 176d55d7715ddecccbe51330e9c012e09972ae3e4a9c9ac8d1c5869b9510540a
MD5 17e018e75d2210e83985eb12255aeaeb
SHA1 e99de10ff0bd2eb7d46f8c95a726bc38221cf5e0
SHA512 43dd835a435c3d86b560ef820b7346fb50c07faf2fc3b526521157f5eabe367583ecd7f134dfedd880a976b15c09780731c4c1bf99faf3019c811fd82942c49a
SSDEEP 96:3fxQDaAXTOWIsCd+IKsPRfh4PmTqTmuxTh:s89Jpxundh
TLSH
T1E481ACA179C18A516BBB891331B25105FF71D0DBA1072964F0CC83371F71DAE67BB68A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/structureProcedure.xsd

SHA256 d323aeb14f98a01583e538dd92ef445e1094db861dc7205d5d2062976de539b3
MD5 09d39d9516ebb8e89cbf56d52dcfa433
SHA1 92c5830335c9282fd378d219a4e091864c3dc9cf
SHA512 9c447a93a819216136706afbcb9ceecc27e07094046e57eae8dd9f7c543389ef47b667e18268bdcf8694cb5568b1df64e8056b97a5e12173bcbd520cd0a4f61d
TLSH
T14541DD95F4C302425B7BC82331B2A344FE22A0E7B1561865F0DDD3271F72EAB256775A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/Schemas/PSMaml/structureTable.xsd

SHA256 63d397b018e5d3783ae3057658d7adcb44f968bfd81329d2fcea1abb91f2c7b8
MD5 8553e57cba6d3e906b7f7d2262a44566
SHA1 284e65bcb4b6c8dff8e2587ab7ea4b48b54ffccd
SHA512 291981470c24010aee40ab76cf9ea849fbf49dca25dd048a17a22632114369101ec55b258f1af8464b3e08021c399f332f1b4c3952760af213c07e5ffa16df9a
SSDEEP 96:3fxQW1r5GTqT0TZ+T/TnT9T08Qyet5t37/iepTFT4TeT/Sz9/3kSTBkuXmRmGQDB:75KuIZSbTp0yM5J7pFBcOS93kGLP01Pm
TLSH
T1ACC1CEA076C217116E7FC91371B6A204FE22A0A7F5032830B08D83371B76D6D75BFA5A
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/structureTaskExecution.xsd

SHA256 c37308c8cdb9ac988c94a850a848fc79707fb5d268f7e17072d6d2fb8e83e852
MD5 04f1a9145feeec74385521908cf8b12d
SHA1 1358d5fe6c4627b16cf42e649ee3479979b31280
SHA512 4b52297cdec45e1d3137203cf8adbc359ce65c05604b836709263e65baa995881b06a1037e5acba9e5620bcef687af5f59d8a49edbca62f6f161039384f45514
SSDEEP 96:3fXvIPDlCAG+zdUaG90C08DGNtA5DnhDeweT9GPCLLnmXIJpfRp8wgQJo4JGDl0m:36CsSCn2LhEIxW5zs+cmWJ1
TLSH
T1A4E17B0474C19E02067A8D365BA3295DFE7094B752462568B4DCB3132F37DA621FB3ED
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/task.xsd

SHA256 808a13ceeebda94c0152b93a52a7825e20b5c01780a3ec6c2ae0c8ac0230ed74
MD5 d31446adac21ffc72917184fb7d2cefa
SHA1 3e662282905a63da4018071b6203d109142ff6dd
SHA512 2f6f633dfccb20aba0711bd0008db31661b0c70f04c00d86f5b1b772a70c2d2cb570bdc651d28d1798e6a58c0d0f67d230555879f2eee3723e883e8f35292201
SSDEEP 384:Q4X2Xl8eOodRGKin8uEWbBJabpP+PvUtOf7DZwIq89Cl6Yj74bnApNsXI43jOPZ5:WOaGKin8uEmBJabpP+PvUtwn64CosMXQ
TLSH
T192A297A479C047126E3B891376729189FF31A0EBF6022624B0DD93331F35D7966BF686
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/Schemas/PSMaml/troubleshooting.xsd

SHA256 fba82fda979c33074968ed01ad95970fcf1151f3e7c298955bd501d5ca554633
MD5 70c05aa9c2918de907d7b437dd0b21c0
SHA1 253eefd01c1fb14795d783abc3e4d41ade49e45d
SHA512 56884c7afcec0b426705354043049486c35503bc0849f9d300cc76e03075b296b2e6ec2e4a40043f3986d05574a7f3142dc4de57f6eac550f8b46c422a865cbd
TLSH
T16C61B095B4C2524167BBC92331B1A705FE6160D7A0532C25F0DD83732F31E6E26AF696
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/WSMan.Format.ps1xml

SHA256 b2736057781d56d20815d4bc170ba74efb7a61b1c5b1d83c7dfc7e3277c4036c
MD5 3af9b088dca7c695b52b49143a8408a8
SHA1 3a3960ba68b8f805dbd485162df65047bfee1195
SHA512 c9450508b4531ee51e69ab8743a0cd1b9f587652420e0d1e3c80fe01cde9f2a776f72f57df03383069311717d577e706f8a842974eb8f161e230a8659481beff
SSDEEP 192:105fj99hJiJlbskdlG6kOlmUkZlGJk+l23k9lKj:105f590+byAxj
TLSH
T1BC721E5323EE551871776A5D3E36C8B44F2BBA61593DCAAE01AC300ECFE7D1286507A3
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/en-US/powershell.exe.mui

SHA256 8df3acb4ba6a5dc37220b0e50323c8f04147b3f5980891871ba537df07458c2e
MD5 e003f3fbf2deb5647ac56f1bfd9177ef
SHA1 e9610b0ebefbc3a5fae09c68e778d7967ce352be
SHA512 183cd92231d2f4d30f994b4842817c90d22e7f8ce829c574ddd9c506832fbca0d9517d97fc5e58e6ca55b781af3a057119aa24c0d119c65fb47a36fa28a26c6f
SSDEEP 96:uMzUUyQOjXwsQUkptXXcrU/L2xsq+SRHyeVip6igy4x8A3+yEXjWY30QM9fjqd4f:uMzyQZLUeVqLV2NyEXjC9fjBWSBbW0
TLSH
T10A329E4143FA4218F4F72F39BCB526600A36FC61FE75D29D5290A01E19B1A25EEB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/getevent.types.ps1xml

SHA256 2255fe380c7d946c82dea10be0287327ebf399f392bf5f482d88cc88b559d10e
MD5 e2aac1a28a83954a37ed4fd8be55303a
SHA1 b3df7e9f8133008bd95a4bc12b2971bcd6bb6dad
SHA512 bdaf306f1d86dc83a7cfebdc6bf67f9a5158e555a8f73960aa0cfe3ecf2f9a3a3c94d52826aceb53c19bdd6a8dd558d51977d285164233928a8f148029bc9d85
SSDEEP 48:yynlyHbGUAVi7Uqoa0VTfuVrZK66qnpp/T96WX2HqimqfT96WX2Hq22TsNXN9YU+:GyUAY3oa05fjqppxDsSbo3ySG8B
TLSH
T1EA12F20327EE1908B2BB152C5576C5B84E6F78A19A39D76D02AC700ECBF7D12DD10BA7
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/powershell.exe.config

SHA256 7bd3f01f04332f1657494e879e861500d520f49b8f9a2a2d511d1d6736c85656
MD5 08b6e3288a865739caaf17c0c4aca361
SHA1 7a1327284d41123773e267bece6409a5b0076dcb
SHA512 ae28578b0cd7bb32a1ff2b13170a6adf4b927cdcfb1ba35982f52565dd7ae809a89f867e0fa298ac01d76b5ea33c1572a341960928e7db064ee6da39c7a7302e
TLSH
T103E061E11FC48C0201F30712C242A600DBBB96E3511E9C56F6FD7C133FA249542B31D1
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/powershell1.exe

IMPHASH a7cefacdda74b13cd330390769752481
SHA256 908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53
MD5 cda48fc75952ad12d99e526d0b6bf70a
SHA1 36c5d12033b2eaf251bae61c00690ffb17fddc87
SHA512 31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0
SSDEEP 6144:kL2yOalAcQjQWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:wCalAcHW2KXzJ4pdd3klnnWosPhnzq
TLSH
T1E1A46B876BD422D5DC3AC435C83344520722BCBAD7919BDB99D8B23D0E712D09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

15184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

powershell.pdb

msvcrt

?terminate@@YAXXZ _onexit __dllonexit _unlock _lock _commode _fmode ??1type_info@@UEAA@XZ _initterm __setusermatherr _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit _XcptFilter __C_specific_handler _vsnwprintf _wcsicmp _wcsnicmp bsearch fclose _wfopen _itow_s wcstoul wcschr __uncaught_exception memmove memcpy _CxxThrowException ?what@exception@@UEBAPEBDXZ ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBV0@@Z ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@AEBQEBD@Z _callnewh malloc wcsncmp wcsrchr free _purecall ??3@YAXPEAX@Z memcpy_s ??_V@YAXPEAX@Z __CxxFrameHandler3 memset

atl

ord30

kernel32

CreateFileMappingW FreeLibrary LoadResource FindResourceExW UnmapViewOfFile GetVersionExW GetLocaleInfoW GetUserDefaultUILanguage GetSystemDefaultUILanguage SearchPathW IsWow64Process MapViewOfFile SetConsoleTitleW LoadLibraryExW GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter GetModuleFileNameW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileType GetModuleHandleExW GetStartupInfoW FindFirstFileW VerifyVersionInfoW GetProcAddress CompareStringW GetModuleHandleW SetLastError VerSetConditionMask GetCurrentProcess GetStdHandle WriteFile LocalFree ExpandEnvironmentStringsW WriteConsoleW Sleep CloseHandle SetThreadUILanguage SetErrorMode UnhandledExceptionFilter FindClose CreateFileW GetFileAttributesW FormatMessageW GetLastError

oleaut32

SysAllocString SysStringLen SysFreeString SafeArrayPutElement SafeArrayCreate VariantClear

advapi32

RegQueryValueExW RegEnumKeyExW RegGetValueW RegCloseKey RegOpenKeyExW

ole32

CoInitializeEx CoInitialize PropVariantClear CoCreateInstance CoUninitialize CoTaskMemAlloc

user32

LoadStringW

mscoree

CorBindToRuntimeEx

HFkiller_full/ps/powershell_ise.exe

SHA256 6cbcd7e7544c5878c07382499440c4878b5da4c8b2c64bc9d81f1a2686330b0f
MD5 30a2792a2428cd06cfec23ecb074889a
SHA1 c7c8939c7780e8e68ac303e6b1abd69892ca39a0
SHA512 f253cb4b5e155bc4a8c1190971167219fb229c83f901aef948f59b4030d3c5247ffc78bcc2c9c062aa98e37970bf54f8a09435a618ddec3ec2f8e166a7b812ac
SSDEEP 3072:19kVjGPsw403LkVjqP4w6U+ToIuWNXmmZTWl/jC7gDooMLEY:TkkuZToIuUXmmZbgDooMD
TLSH
T1AB241A65B74057EBE73281706CD37061067B7C77E2B07A9E24EA339B0EB2C96602255F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

powershell_ise.pdb

HFkiller_full/ps/powershell_ise.exe.config

SHA256 a308b73fa126b77980ff3f1419bcd87780ac0784997e92b497d6915a790580f1
MD5 e861ba5a5869695af4a5171e7e8578e0
SHA1 8110e1a31e3711c62fdb172a840ba8aebfa3c48c
SHA512 6f710031b51e8cf109031458fa513d45bb4699509c969e6f02d7bfab548df947eea881211323e352ade0382ac23dc54056b5958e55b2a064d07b41de3d4b1013
TLSH
T1B4F0E5314AE0EC6625220F2792238515DF3522F2A42C9488F9FF79125FF665C0A7332A
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/pspluginwkr.dll

IMPHASH 36f7ca9a5caab24901fb951dfddee8fc
SHA256 da11e51b6867e233c9dab60cf0edd93410ec6c382acf853d0b79005d3735b03a
MD5 0bb0f55d6f3b11404ea88755caa92ac7
SHA1 dc1ecc10d10364569fa2c598204e5572dd2ff890
SHA512 7ab43683cf67911417705da60a31a7f0cc255d1840ce9ab640d6ca86ce2afd0287fd9580f0bd139292b61b41af2c415b5dbfe0cb0451fda1e10540963d0eaf9f
SSDEEP 3072:tQCVcDd5iviyNXMmrBi38GIXIH47dlDtXLfk+0FWvGO5l+z44tGjRKGavOBpDd/b:tQlB5iviyNXMmrBi38GIXIH47dlDtXLB
TLSH
T1AB046B013BD409AAF49F877264F1C280B277D8835B6567CB513161B82DEE7C8DA399B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

162484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pspluginwkr.pdb

msvcrt

isleadbyte __pioinfo _iob ??0exception@@QEAA@AEBV0@@Z memset _callnewh ?terminate@@YAXXZ abort ??0exception@@QEAA@AEBQEBDH@Z memmove _cexit wcsncmp ??2@YAPEAX_K@Z _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@XZ ??1exception@@UEAA@XZ _wcsicmp _wcsnicmp _vsnwprintf bsearch ??1type_info@@UEAA@XZ ??3@YAXPEAX@Z __C_specific_handler _amsg_exit free _initterm malloc _XcptFilter _errno ?what@exception@@UEBAPEBDXZ __badioinfo _snprintf _itoa wctomb _lseeki64 _write _isatty _fileno memcpy

kernel32

LoadLibraryExW LoadResource FreeLibrary FindResourceExW GetSystemDefaultUILanguage UnmapViewOfFile MapViewOfFile SearchPathW UnregisterWaitEx FormatMessageW LocalFree Sleep QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime RtlPcToFileHeader GetLocaleInfoW GetVersionExW CreateFileW CreateFileMappingW GetUserDefaultUILanguage CloseHandle SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlCaptureContext RtlVirtualUnwind OutputDebugStringA GetLastError GetVersion SetLastError VirtualQuery RtlLookupFunctionEntry LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection RegisterWaitForSingleObject

mscoree

CorBindToRuntimeEx _CorDllMain

ole32

CoCreateInstance

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW EventWriteTransfer EventWrite EventUnregister EventRegister EventActivityIdControl

wsmsvc

WSManPluginOperationComplete WSManPluginReceiveResult WSManPluginGetOperationParameters WSManPluginReportContext

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HFkiller_full/ps/pwrshmsg.dll

SHA256 458d478fd6625939ad120b17777ef38b09b1baae5bc78ab7f4fc18640d6ce5f9
MD5 493deb694461be1b5ca1b094ed913e35
SHA1 2fca1020b9ebee6aa19ace491b71ac8db1c92319
SHA512 daafc6deaf7f67080355f24b2ead81da824a646361a2a593a02c03e8e8b6597d4825842a152aca65fb6757c9471120cb36eb14549c19e4634f688f5a3cfdbfc4
TLSH
T1E8515B4653F90659F4FE0F315ABB9A2A663ABC24DA36D75C0980102D2C75A25EC70F37
MD5 SHA1 SHA512 TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/pwrshsip.dll

IMPHASH d9d7c00e2eaf03f74330d8f1204c0a12
SHA256 b6d1290031da360d04b10a9425fbc50bbb0ed1d303373db4f3d8b75ee7632b78
MD5 9460482211e051f6eb157de1d1970cc3
SHA1 0cc8cb26997ef90d096f5be0c124fbb7c84d15ef
SHA512 eeaf154fff98df451d378ecfba6d14f65b3147aaef09408e4de61f8ed11e8be5632c0098f0514457a7395a68927ab2201b2000a9b7584be37ba70d01ef999998
SSDEEP 768:wT1abVmUCEr7mHjX4lI/byrWahoMczkL1UAk2:M1sPdmDIlirzcV
TLSH
T1BFD22996B26C00A9F1F6A37D8E66561BD6B1B5113321D7CF0370076D2F23BD6AA38346
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

19920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pwrshsip.pdb

HFkiller_full/ps/types.ps1xml

SHA256 1f4990c289b2466c61c3cbd35edeaaf99430a3492340d52a84f5d8a0ef6be1a0
MD5 dc84bcbc49097a0e97a6a798be6cfbc0
SHA1 9148dfda0a1948a532890f5fd347c9e72955c7b2
SHA512 549e023618381da9e52a01f7254df0a54ddeaafdfb7e53fd91984ba199398e88ff02a8c0c3abca027316bcf12b90faf8cf78d134f3e8a04805a324f7d2b85a29
SSDEEP 768:XhrHFZ/CfHUplOOGcO2VX7bpVj/GsAsJiV//nrLJcl0upFl1sfUOlq78mtzREgUy:xn2ZYXf
TLSH
T19324D704F2ECD86158B4143BAD226983EE11965F0A7A4079F2EC47176F31CE9A9B3D73
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/typesv3.ps1xml

SHA256 6160f07fc4681c61a1ca33940b5e4f366c73fba86c2671b037d05fdd5eadaf64
MD5 c877e83d10ee63eb2a6ac3db2bc9699f
SHA1 d9fc18041c0f13becb9b2d67b44870ab1d014b2b
SHA512 4a3a2b9d0ef45fe0283036c17ae3c6ac8b8113c69d9dfbd247cb9d6326cdfed38892438578d39979bb9d62f2f25da219c7885fef6fb2861f438099575bcfc93c
SSDEEP 96:Rxq5JIgt4oAoo/565zZm6yGayGYZTZNYLu9yvFE37BSjiEQ+7xxo:RkV4oAooBsV31NClaAjzU
TLSH
T15C420704F2ECC98148B4542B9D22AD52EE61929F057B84ADF6CC4B531F70DCCAAA3F75
MD5 SHA1 SHA512 SSDEEP TLSH

HFkiller_full/ps/zh-CN/PSEvents.dll.mui

SHA256 af6b9c8a5e2430a07a4d90f9ac8d98e42553e8fa614bc027781489b58df1728f
MD5 2249f47d633903581804490df5fef14e
SHA1 371f427d1021fc929389ac7a33e8ae997e3c768d
SHA512 00100662dc79145c515dcb2a55f8633d2c7e193033006be2f2b2344493cd36f587dd0c18af22d848ab053dd314d76bf0023dedf24ffe5848257f845a1eb2ad9b
SSDEEP 768:jXffP7Q/r8iuQsAHN+XzSyVwzJImIrb9IkPDQU329:jXffP7WvkPDQUG9
TLSH
T180F29C1623FB8058F0B20B347EB6E16527B6BCC56935C48E66C4E13E7CE6924AC21777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/zh-CN/default.help.txt

SHA256 7f526721064e78ed098d758501686fa5cab48e2b8a8d06d7b17a244ff07dc600
MD5 f4208a599c34cca7a0c85dcb7cd0df18
SHA1 6f177b41fb95c5b1df75e0a458074793d2d1d056
SHA512 e44f933d6d2c726acca5992ff840f3ee46ddcc30d09c878ddab6956d0420160c35522e1ab76220411e2c7dd054c0ce0a55f0c2812bae16ab46104a09b9769022
TLSH
T16571BE680B7E4DD466F6605D665D952AD6703223827B3A54F5EE0A283F32F50C1BCF4C
MD5 SHA1 SHA512 TLSH

HFkiller_full/ps/zh-CN/powershell.exe.mui

SHA256 69e048dd674484e37108a64e07b7f2ff64013619f18e0b70e8c3775a8dbb50e3
MD5 577d1b4a99fe1b632519e9e1acb550a7
SHA1 1c6001971b56c4971fe3291f322d3e756a34e815
SHA512 525412758701283784de30db4567508f0e8a9d93d2e2a3a544e5cd1e0d7219c39cadaf7d36be121aeb438b8759502cee85a960a11bb9c3c2fe28b241b2d70cea
SSDEEP 96:itvYOI63fBGU1QdBkDb28sSZxv2nhagHnM129ND0WSBbWwe:iKOI63fUUARSZxO7Hw2j0WSBbWR
TLSH
T132F1344007F71058F5FA4B3CFCF6621053B1FC64EE29859E62A9A41A2970926FE3477B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/zh-CN/pspluginwkr.dll.mui

SHA256 f718e3c6d8672bbd410149cf32b30aa0a221c7536daeb77b781ff968006f07d1
MD5 a51e53570201d69e5b1832ce2964b922
SHA1 672252bc3220bb709a074765ce544612ca6ac6b6
SHA512 6c0fe3f72defac396675d5c9e47cd32be80dbac7a5ed53408d064578691a40bc2aeb82e8af0d694ba4c03494e96a833fda72d9b87a3b8ea83b388a1466a02a5e
TLSH
T1BB815E4917B71115F1B50E34EDB542A12BBD7C53FE56522EDA54241928F010BAFB0FB3
MD5 SHA1 SHA512 TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/zh-CN/pwrshmsg.dll.mui

SHA256 aa25ffb42b70481b2ae3cf76e8b91120d5996321313acb97dd8bf44726ced1f7
MD5 333396a53106b7e026bfd29b665ebda8
SHA1 1ff67c77c9c561b208f2ec08f4f4f86d403a5137
SHA512 994b91bd46cc0fbcc6dbec78a4a099e2931e977de7daa58847bda56ac7efad7859f0c8061ad69cbbf3bb36699a6f5d82079335cef18764512d825a70ec284e62
TLSH
T1C881BF0743DB061BE1BB4B3845378A3A2375EC8A41764658AAD1F3383CE1D21ADA07F7
MD5 SHA1 SHA512 TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/ps/zh-HANS/powershell_ise.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c1a3ba36b1f322ee53d4972bf77c5813833f1d96b4d88d979f7638d34edeb793
MD5 3413e21bcf53c2c96b8831d721fd1ca8
SHA1 308ff645334b79252ed42d5fa710270d490d713f
SHA512 a621dbe559e1a9ef8b32e04de73c75ce5eabf0a2bdc903df93befe26ea35b5dcb763790b295bf4050a1f415920a15a407c1e5503030a5be27b654ebf8c4ed9bc
SSDEEP 768:/k90mNwoLv9/4xRXTpiWVpUrcZLbbMMl1IQh8FFts5rHlCiYkEC0fg+tTtpAQd2X:/k9zuojSz88swctu025GJmwI
TLSH
T17A433166764067EBE73241706CC371A21ABF7C77E2B0798E24E633970DB3C9A642115E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

64078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

HFkiller_full/web/index.html

SHA256 4a7e2f2cd8478155e85ad66f8bf5d998321cb06df065d17b89d7704a3c91a0a6
MD5 e28f580f8c02a6d1d10987f14739d614
SHA1 5ace34d57efd1b2d26ab7dd0554ddc8a82cf84d3
SHA512 e696b361906f31766a1ba893bed0bf8c348db4f6d013f7b623c19ab4e8bf9b7b5012ec8d7fd5a275bb7c4ec2c59e4fe6e5c62494853081059a6a817faa8af78a
SSDEEP 96:9wruIGvPSyNcaOGD+fx9Io92jtlgqaDWogZwUwqUwYZwJadlGOE/s0FLnp7V7:eruIGXLmaOGDk9Io9SlgqaDLgZwUwTwB
TLSH
T168C1739B56770406B617E4AC7B22579B2509A507C00ACAAC3FBCE76CDF848E48DB374C
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

Sharing

General

Malware Config

Signatures

File Explorer

HFkiller_full.zip

HFkiller_full/HFkiller_full.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

HFkiller_full/HFkiller_full.pdb

HFkiller_full/ps/Certificate.format.ps1xml

HFkiller_full/ps/Diagnostics.Format.ps1xml

HFkiller_full/ps/DotNetTypes.format.ps1xml

HFkiller_full/ps/Event.Format.ps1xml

HFkiller_full/ps/Examples/profile.ps1

HFkiller_full/ps/FileSystem.format.ps1xml

HFkiller_full/ps/Help.format.ps1xml

HFkiller_full/ps/HelpV3.format.ps1xml

HFkiller_full/ps/Modules/AppBackgroundTask/AppBackgroundTask.psd1

HFkiller_full/ps/Modules/AppBackgroundTask/MSFT_BackgroundTask.Format.ps1xml

HFkiller_full/ps/Modules/AppBackgroundTask/Microsoft.Windows.AppBackgroundTask.Commands.dll

mscoree

dotnet

HFkiller_full/ps/Modules/AppBackgroundTask/PS_BackgroundTask.cdxml

HFkiller_full/ps/Modules/AppLocker/AppLocker.psd1

HFkiller_full/ps/Modules/AppvClient/AppVClientCmdlets.format.ps1xml

HFkiller_full/ps/Modules/AppvClient/AppVClientCmdlets.psm1

HFkiller_full/ps/Modules/AppvClient/AppvClient.psd1

HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.AppVClientPowerShell.dll

generic

HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.AppvClientComConsumer.dll

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

advapi32

kernel32

normaliz

oleaut32

wininet

ole32

mscoree

generic

HFkiller_full/ps/Modules/AppvClient/Microsoft.AppV.ClientProgrammability.Eventing.dll

mscoree

dotnet

HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppVClientPowerShell.resources.dll

mscoree

dotnet

HFkiller_full/ps/Modules/AppvClient/zh-HANS/Microsoft.AppV.AppvClientComConsumer.resources.dll

mscoree

dotnet

HFkiller_full/ps/Modules/Appx/Appx.format.ps1xml

HFkiller_full/ps/Modules/Appx/Appx.psd1

HFkiller_full/ps/Modules/Appx/Appx.psm1

HFkiller_full/ps/Modules/Appx/zh-CN/Appx.psd1

HFkiller_full/ps/Modules/AssignedAccess/AssignedAccess.psd1

HFkiller_full/ps/Modules/AssignedAccess/AssignedAccess.psm1

HFkiller_full/ps/Modules/AssignedAccess/zh-CN/AssignedAccessMsg.psd1

HFkiller_full/ps/Modules/BitLocker/BitLocker.Format.ps1xml

HFkiller_full/ps/Modules/BitLocker/BitLocker.psd1

HFkiller_full/ps/Modules/BitLocker/BitLocker.psm1

HFkiller_full/ps/Modules/BitLocker/Microsoft.BitLocker.Structures.dll

mscoree